Technology July 24, 2026 · 10:00 Kumaran Kumarathurai

Secure Website

Secure HTTP response headers

HTTP headers tell the browser how to handle your page. Correctly configured headers protect against a range of common attacks.

Content-Security-Policy (CSP): restricts which sources the browser may load scripts, styles, and other content from, protects against XSS attacks
Strict-Transport-Security (HSTS): forces the browser to always use HTTPS for your domain
X-Content-Type-Options: nosniff: prevents the browser from guessing file types incorrectly
X-Frame-Options: prevents your site from being embedded in other people's pages (clickjacking protection)
Referrer-Policy: controls how much information is sent to other sites when a visitor clicks an outbound link
Permissions-Policy: restricts which browser features (camera, microphone, location, etc.) your site can request access to

Useful tools: SecurityHeaders.com (test your headers for free), the Mozilla HTTP Observatory (full security scan), and SSL Labs (test your SSL/TLS configuration).

Cloudflare is free to get started with, and offers several layers of protection in one service:

DDoS protection: absorbs and filters malicious traffic before it reaches your server
WAF (Web Application Firewall): automatically blocks known attack patterns (SQL injection, XSS, and others)
SSL/TLS encryption: free certificate, automatic renewal, and support for modern TLS versions
Bot Fight Mode: challenges and blocks automated bots without affecting genuine visitors
Rate Limiting: limits how many requests a single IP address can send within a time window, prevents brute-force attacks and abuse
Page Rules / caching rules: optimises load time and reduces load on your origin server

Even the most secure website can face incidents (hardware failure, ransomware, human error). A solid backup strategy is your last safety net.

Follow the 3-2-1 rule: three copies of your data, on two different media types, with one stored offsite
Automate your backups so they run without manual intervention
Regularly test that restoring actually works, a backup you cannot restore from is not a backup
Consider encrypted backups, especially if they contain personal data

Backblaze is an affordable, reliable option for cloud backup.

Keep software updated: Docker images, nginx, operating system, and all dependencies, vulnerabilities in outdated software are one of the most common attack vectors
Principle of least privilege: run containers and processes with the fewest possible permissions, never as root without reason
Fail2ban or CrowdSec: automatically detects and blocks repeated login attempts and malicious traffic
Never commit secrets to Git: use .env files and keep them out of version control (.gitignore)
DNSSEC: protects your DNS lookups against spoofing and manipulation
Force HTTPS: redirect all HTTP traffic to HTTPS, no unencrypted traffic should be accepted
Restrict admin access: only allow SSH/admin panel access from specific IP addresses, or require a VPN
2FA on the infrastructure itself: enable two-factor authentication on your hosting, domain, and Cloudflare accounts, not just the website itself