Website security basics every site owner should know
By the LaunchSafer team ·
HTTPS, security headers, exposed secrets and the other basics that prevent most avoidable security problems.
You don't need to be a security engineer to avoid the most common website security mistakes. These basics cover what a public scan can see.
HTTPS everywhere
Serve every page over HTTPS with a valid certificate and redirect HTTP to HTTPS. Most hosts provide free certificates. Make sure automatic renewal works — expired certificates show visitors a full-page warning.
Security headers
These HTTP response headers tell browsers to apply extra protections:
- Strict-Transport-Security — always use HTTPS for your domain.
- Content-Security-Policy — restricts which scripts can run, limiting cross-site scripting damage. Start in report-only mode.
- X-Content-Type-Options: nosniff — stops browsers guessing file types.
- X-Frame-Options or CSP
frame-ancestors— prevents clickjacking. - Referrer-Policy — limits how much of your URLs leak to other sites.
Never publish secrets
API keys for payment providers, databases or AI services must stay on the server. If one ever appears in your page source or JavaScript, revoke it immediately — assume it has been copied.
Keep software updated
Most compromised small sites run outdated CMS plugins or themes. Enable automatic updates where you can and remove plugins you don't use.
What a public scan can't tell you
An external scan only sees what any visitor sees. It can't test your login security, server configuration or code. For sites that handle sensitive data, a professional security review is worth the investment.