Website Security Foundations

Define secure websites as up to date, well configured, with encrypted data transfer, input validation, and protected access, covering server, front-end and back-end code, components, and CMS configurations.

Introduce key website security concepts, including vulnerabilities and exploits, validation and sanitization, authentication and authorization, cryptography and encryption, hashing, same-origin policy, and cross-origin resource sharing.

Explore common web attack types—SQL injection, cross-site scripting (XSS), CSRF, session hijacking and fixation, clickjacking, path traversal, brute force, and DoS and DDoS—with practical examples and mitigations.

Protect server files by avoiding public access and storing sensitive items outside the root directory. Implement authentication with htpasswd and htaccess, and control permissions using chmod values such as 640.

Minimize third-party components to reduce security risks and vulnerabilities, while selecting well maintained, licensed, and trusted libraries; monitor upgrades and test compatibility to balance speed and safety.

Learn how to secure sites by adjusting server configuration for Apache, Nginx, or Microsoft's IIS, including per-directory .htaccess, web.config, error pages, and disabling trace methods like TRACE and TRACK.

Configure HTTP headers for security with .htaccess and PHP header(). Protect against clickjacking with x-frame-options, disable sniffing with x-content-type-options nosniff, and implement content security policy and strict transport security.

Explore the ng firewall, a complex rule set that blocks dangerous requests, injections, bots, and spam. Implement it by placing the .htaccess text and debug by selectively disabling rules.

Secure web communications by encrypting data with SSL/TLS and HTTPS, preventing eavesdropping, data modification, and session hijacking, and learn how certificates such as Let's Encrypt and Certbot enable easy deployment.

Enforce https sitewide by eliminating mixed content and updating all resources to https, including protocol-relative urls. Use WordPress 5.7+ one-click migration or wp-cli search-replace, including serialized data, with dry-run options.

Redirect all http requests to https using an .htaccess 301 rule, then implement strict transport security with max-age and includeSubDomains to protect first visits and cookies.

Explore front-end security basics, including browser manipulation, dangerous resources, and information leakage from comments. Recognize that front-end validation is cosmetic and requires back-end checks to prevent attacks.

Learn how external resources threaten site security, implement subresource integrity with sha384 checksums and the integrity attribute, and use crossorigin; disable window.opener with noopener or noreferrer for external links.

Learn to defend against clickjacking by implementing the X-Frame-Options header with DENY or SAMEORIGIN, adopting content security policy, and using iframe sandbox and frame-ancestors to control embedding.

Move admin CSS to an external PHP file guarded by access control. Check permissions before outputting link or content; return 404 for unauthorized access to reduce leakage and caching risk.

Learn to secure JavaScript by avoiding risky third-party scripts, using reliable frameworks, applying subresource integrity, avoiding eval and its relatives, and preferring JSON transport, with back-end separation when needed.

Upgrade to the latest PHP version to boost security and performance. Harden PHP configuration, secure file inclusion, and implement safe database connections while preparing password and session management.

Learn how php.ini configures php on servers, when to override with .htaccess, .user.ini, or ini_set, and review essential security directives for error handling and sessions.

Define a global constant before include files and check it at the start of each file to prevent direct execution and remote inclusion.

Compare mysqli and PDO for MySQL connections, demonstrate object-oriented and procedural usage, and emphasize secure practices: error handling, prepared statements, and encoding.

Store database credentials as constants in a PHP file and move it outside the public root; restrict access with .htaccess and set permissions (400/640) to prevent exposure and path traversal.

Explore safe PHP data handling: use json_encode/json_decode for serialization, avoid unserialize with untrusted data to prevent code execution, and leverage $_GET, $_POST, and $_SESSION wisely.

Understand how seeds and entropy affect randomness in computers and why cryptographically secure pseudorandom numbers matter. Learn how PHP offers random_int and random_bytes to generate secure tokens and strings.

Explain how to securely store and verify passwords using modern hashing algorithms and PHP's Password Hashing API, including bcrypt and Argon2, rehashing, and timing-attack safe comparisons with password_verify and hash_equals.

Learn how per-user random salts protect passwords from rainbow tables and how pepper, when used with password_hash(), can further improve security.

Proactively migrate all users to the Password Hashing API by adding a migrated flag, using legacy verification during transition, then apply strong hashes for future logins.

Design password policies to deter brute force with long passwords and characters from at least three groups, and consider a library like zxcvbn to balance security and usability.

Explore how http's stateless design uses session identifiers to enable logins, and guard against session hijacking, fixation, and csrf with ssl and php settings.

Implement a non-persistent session cookie with server-side inactivity checks and a defined absolute expiration, updating last activity timestamps and renewing session IDs on login while informing users before expiry.

Regenerate the session ID after authentication and before storing data, destroy the old session, and delete the session cookie to prevent hijacking, while guarding against CSRF, XSS, and SQL injection.