Website security explained: HSTS, CSP, TLS, DNSSEC and more

A few headers and DNS records go a long way in protecting your website. Here is what they do, what they look like and where things go wrong in practice.

• HSTSHSTS tells browsers to reach your website over HTTPS and nothing else. Adding the header takes a minute. Extend it to every subdomain too early, though, and you may lock yourself out of your own test server.
• CSPA Content-Security-Policy tells the browser where your site may load scripts, images and other content from. A script slipped into the page then has nowhere to run.
• Security headersBesides HSTS and CSP, a handful of smaller headers each close one specific gap with a single line of configuration. Others still sit in many templates long after browsers stopped paying attention to them.
• TLS and certificatesThe padlock in the browser says little about how well a connection is actually protected. Behind it sit a certificate that identifies the server and the TLS protocol that encrypts the data, and either can be wrong in ways nobody notices for months.
• CAAAny public certificate authority can issue a certificate for your domain once domain validation succeeds. A CAA record in DNS narrows that down to the authorities you actually use.
• DNSSECDNSSEC signs your domain's DNS answers so that nobody can quietly send your visitors to someone else's server. Switching it on is quick. After that, the DS record at your registrar has to keep matching the zone's key.
• security.txtSomeone who spots a flaw on your website first has to work out who to tell. A short text file in a fixed location answers that question for them, as long as someone keeps it current.