Website Security: Questions Answered
How to check whether a website is secure, which security headers to set, how Content Security Policy and DMARC work, the most common web vulnerabilities, and what to do if a site is hacked.
Each answer below gives the short version first. Open the full article for the steps, the reasons and the official sources.
7 questions on Website Security
| Question | Short answer |
|---|---|
| rel="noopener": When It Matters and When It's Noise | Rel=noopener only matters for links that open another site in a new tab with target=_blank and lack noopener or noreferrer. Since around 2021, Chrome, Firefox, Safari and Edge apply noopener to such links automatically, so a missing one is a low-risk best-practice item. |
| Stray Files in Your Web Folder That Anyone Can Download | Anything in your public web folder can be downloaded by anyone. To clear stray files in your web folder, list non-page files such as .txt, .bak and .old, check which return a 200 status, move unneeded ones to a private folder outside the web root, and confirm each now returns 404. |
| How do I check if my website is secure, and what should I do if security headers are missing? | Scan your domain with Mozilla HTTP Observatory, which grades your HTTP security headers, and check the Security issues report in Google Search Console for hacking or malware. If headers are missing, add them at your server, host or CDN, starting with the low-risk ones, and test a Content Security Policy in report-only mode before enforcing it. |
| What are the 10 most common web security vulnerabilities? | The standard reference is the OWASP Top 10, and the current edition is 2025. In order, it lists Broken Access Control, Security Misconfiguration, Software Supply Chain Failures, Cryptographic Failures, Injection, Insecure Design, Authentication Failures, Software or Data Integrity Failures, Security Logging and Alerting Failures, and Mishandling of Exceptional Conditions. |
| What is a Content Security Policy, and what does default-src mean? | A Content Security Policy is an HTTP response header that tells browsers which sources a page may load scripts, styles, images and other resources from, mainly to defend against cross-site scripting. default-src is the fallback value the browser uses for any fetch directive, such as script-src or img-src, that the policy does not set. |
| How do I fix a hacked website? | Take the site offline, tell your host and change every password, then find the weakness the attacker used. Restore from a clean backup or rebuild, update all software, remove anything the attacker added, and only then ask Google to review the site through the Security issues report in Search Console. |
| What is DMARC, is it now required, and how do I add it? | DMARC is an email authentication, policy and reporting protocol that builds on SPF and DKIM. Gmail requires it if you send more than 5,000 messages a day to Gmail accounts, Microsoft requires it for domains sending 5,000 or more messages to Outlook.com, and Yahoo requires it of bulk senders. You add it as a DNS TXT record at _dmarc.yourdomain, starting with p=none and moving to quarantine and reject. |