Protect Websites
Secure websites prevent attackers from modifying pages, stealing information, spreading malware, or taking services offline.
Cybersecurity Topic
Web Security
Web security protects websites, web applications, servers, databases, users, and online information from attacks, unauthorized access, data theft, and disruption.
Protecting Online Systems
What Is Web Security?
Web security is the practice of protecting websites, web applications, APIs, servers, databases, and users from vulnerabilities and malicious activity.
Protect Users
Web security protects usernames, passwords, payment information, personal details, and account activity.
Protect Data
Secure coding, encryption, authentication, and access controls help prevent unauthorized access to application data.
Web Application Architecture
How Web Applications Work
A web application usually contains several connected layers. A weakness in any layer may expose the entire application to attack.
Web Browser
The browser displays HTML, CSS, images, and JavaScript while sending requests to web servers.
Web Server
The web server receives requests and returns website files, application responses, and other content.
Application Server
Application code processes user input, account actions, business logic, and requests for data.
Database
Databases store user accounts, products, orders, messages, settings, and other application records.
APIs
APIs allow websites, applications, servers, and third-party services to exchange information.
Cloud Services
Cloud platforms may provide hosting, storage, authentication, databases, and content delivery.
Secure Communication
HTTP and HTTPS
HTTP transfers website information between browsers and servers. HTTPS adds encryption through TLS, helping protect information from interception and modification.
HTTP
HTTP traffic is not encrypted. Information may be visible to someone monitoring the network connection.
- Typically uses port 80
- No transport encryption
- Vulnerable to interception
- Not recommended for sensitive data
HTTPS
HTTPS encrypts communication and helps users confirm that they are connected to the expected website.
- Typically uses port 443
- Uses TLS encryption
- Requires a digital certificate
- Protects data in transit
Common Web Threats
Web Application Vulnerabilities
Attackers search for weaknesses in application code, user input handling, authentication, permissions, server configuration, and software components.
SQL Injection
SQL injection occurs when unsafe user input is included in a database query. An attacker may read, change, or delete database information.
Cross-Site Scripting
Cross-site scripting allows malicious JavaScript to run inside another user's browser through an unsafe webpage.
Cross-Site Request Forgery
CSRF tricks a signed-in user's browser into sending an unwanted request to a trusted website.
Broken Access Control
Broken access control allows users to view or change resources that should be restricted.
Authentication Failures
Weak login controls, insecure passwords, predictable reset links, or poor session management may allow account takeover.
Security Misconfiguration
Default settings, exposed files, unnecessary services, detailed error messages, and weak permissions can expose a web application.
Vulnerable Components
Outdated frameworks, plugins, libraries, and server software may contain publicly known vulnerabilities.
File Upload Vulnerabilities
Unsafe upload features may allow attackers to place malicious scripts or dangerous files on a server.
Server-Side Request Forgery
SSRF may allow an attacker to force a server to send requests to internal systems or restricted services.
Database Security
Understanding SQL Injection
SQL injection targets applications that build database queries using untrusted user input. Secure applications use parameterized queries rather than combining input directly with SQL.
✓
Use parameterized queries or prepared statements
✓
Validate and restrict user input
✓
Use database accounts with limited permissions
✓
Do not reveal detailed database errors to users
Secure Query Example
Protected
const query =
"SELECT * FROM users WHERE email = ?";
database.execute(
query,
[userEmail]
);The user value is handled separately from the SQL command, reducing the risk that it will be treated as executable database code.
Browser-Based Attacks
Cross-Site Scripting
Cross-site scripting, also called XSS, occurs when untrusted content is inserted into a webpage without being safely handled.
Stored XSS
Malicious code is saved inside a database or website and later displayed to other users.
Reflected XSS
Malicious input is immediately returned in a webpage, often through a link or search request.
DOM-Based XSS
Client-side JavaScript changes the webpage using unsafe data without proper validation or encoding.
XSS Prevention
✓
Encode output before displaying user content
✓
Validate input using allowlists
✓
Use a Content Security Policy
✓
Avoid unsafe DOM functions
Account Protection
Authentication and Session Security
Secure authentication verifies user identity, while secure session management protects the user after a successful login.
Strong Password Storage
Passwords should be stored using a strong, salted password-hashing algorithm rather than plain text or reversible encryption.
Multifactor Authentication
MFA requires an additional verification method, reducing the risk caused by stolen passwords.
Secure Cookies
Session cookies should use Secure, HttpOnly, and appropriate SameSite settings.
Session Expiration
Sessions should expire after inactivity, logout, password changes, or suspicious activity.
Login Protection
Rate limiting and temporary lockouts can reduce password guessing and automated attacks.
Secure Password Reset
Reset links should be random, temporary, single-use, and delivered through a verified method.
Build Security Into the Code
Secure Coding Practices
Secure coding reduces vulnerabilities before an application is deployed and makes future maintenance safer and easier.
01
Validate User Input
Accept only expected data types, formats, lengths, and values.
02
Encode Output
Encode untrusted content before displaying it inside HTML, JavaScript, CSS, or URLs.
03
Use Least Privilege
Applications, databases, and users should receive only the permissions they require.
04
Protect Sensitive Data
Encrypt sensitive information in transit and at rest where appropriate.
05
Handle Errors Safely
Record useful technical details in protected logs without exposing them to website visitors.
06
Update Dependencies
Regularly patch frameworks, libraries, plugins, servers, and development tools.
07
Review and Test Code
Use code review, automated scanning, and security testing before deployment.
Browser Security Controls
Important HTTP Security Headers
Security headers tell browsers how to handle website content and can reduce several common attack techniques.
| Security Header | Purpose |
|---|---|
| Content-Security-Policy | Restricts which scripts, styles, images, and other resources may load. |
| Strict-Transport-Security | Tells browsers to use HTTPS for future connections to the website. |
| X-Content-Type-Options | Prevents browsers from guessing a file's content type. |
| Referrer-Policy | Controls how much referral information is shared with other websites. |
| Permissions-Policy | Controls access to browser features such as cameras, microphones, and location. |
| Cross-Origin-Opener-Policy | Helps isolate browsing contexts and reduce certain cross-origin attacks. |
Security Testing Software
Web Security Tools
Security professionals use specialized tools to inspect requests, test applications, identify vulnerabilities, and monitor website activity.
OWASP ZAP
Web Application Scanner
OWASP ZAP can intercept web traffic and scan applications for common security weaknesses.
Burp Suite
Web Testing Platform
Burp Suite provides tools for intercepting requests, modifying traffic, testing input, and analyzing application behavior.
Browser Developer Tools
Client-Side Inspection
Developer tools help inspect HTML, CSS, JavaScript, cookies, storage, requests, and browser errors.
Nikto
Web Server Scanner
Nikto checks web servers for outdated software, unsafe files, configuration problems, and known weaknesses.
sqlmap
Database Injection Testing
sqlmap automates authorized testing for SQL injection vulnerabilities in web applications.
Web Server Logs
Activity Monitoring
Server logs can reveal failed logins, unusual requests, scanning activity, errors, and attack attempts.
Application-Layer Defense
Web Application Firewalls
A Web Application Firewall, or WAF, filters HTTP and HTTPS traffic between users and a web application. It can block suspicious requests before they reach the application server.
✓
Filters malicious requests
✓
Helps reduce SQL injection and XSS attacks
✓
Applies rate limits and access rules
✓
Records suspicious web activity
User
→
Web Application Firewall
→
Web Application
Website Protection
Web Security Checklist
Website owners and developers should use multiple defensive controls rather than relying on a single security feature.
01
Use HTTPS Everywhere
Protect all pages, logins, forms, APIs, and administrative areas with TLS.
02
Keep Software Updated
Patch the server, CMS, themes, plugins, frameworks, libraries, and databases.
03
Protect Administrative Accounts
Use strong passwords, MFA, limited permissions, and protected login pages.
04
Validate Input
Treat all user-controlled information as untrusted until it has been verified.
05
Back Up Website Data
Maintain secure backups of files, databases, configurations, and important content.
06
Monitor Logs
Review login activity, application errors, server requests, and security alerts.
07
Test Regularly
Perform vulnerability scans, code reviews, configuration checks, and authorized testing.
Review Your Knowledge
Web Security Knowledge Check
What does HTTPS protect?
HTTPS encrypts information traveling between a browser and a web server and helps verify the identity of the website.
What is SQL injection?
SQL injection occurs when unsafe input changes the meaning of a database query.
What is cross-site scripting?
Cross-site scripting occurs when malicious script content runs inside another user's browser through an unsafe webpage.
Why should passwords be hashed?
Strong password hashing helps protect stored passwords if an application's database is exposed.
What does a Web Application Firewall do?
A WAF inspects web requests and may block suspicious traffic before it reaches the web application.
Web Security Summary
Build Safer Web Experiences
Strong web security combines secure coding, encrypted communication, authentication, access control, updates, monitoring, testing, and careful server configuration.