Here are some HTML and web security tips and codes to secure your VTU website from common vulnerabilities and attacks

Here are some HTML and web security tips and codes to secure your VTU website from common vulnerabilities and attacks - Printable Version

+- Shediweb Forum (https://shediweb.com.ng)
+-- Forum: Programming (https://shediweb.com.ng/Forum-Programming)
+--- Forum: Html (https://shediweb.com.ng/Forum-Html)
+--- Thread: Here are some HTML and web security tips and codes to secure your VTU website from common vulnerabilities and attacks (/Thread-Here-are-some-HTML-and-web-security-tips-and-codes-to-secure-your-VTU-website-from-common-vulnerabilities-and-attacks)

Here are some HTML and web security tips and codes to secure your VTU website from common vulnerabilities and attacks - Shedi - 01-18-2025

1. Use Content Security Policy (CSP) to Prevent XSS
Add a CSP header to restrict sources of scripts and content that can run on your website.

Code:
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:;">

This prevents unauthorized scripts from running on your site.

2. Enable HTTP Strict Transport Security (HSTS)
Ensure your website always uses HTTPS for secure communication.

Code:
<meta http-equiv="Strict-Transport-Security" content="max-age=31536000; includeSubDomains">

3. Disable Browser Caching for Sensitive Data
Prevent sensitive data from being stored in browser cache.

Code:
<meta http-equiv="cache-control" content="no-cache, no-store, must-revalidate">

<meta http-equiv="pragma" content="no-cache">

<meta http-equiv="expires" content="0">

4. Secure iFrames with X-Frame-Options
Prevent clickjacking by disallowing your site to be embedded in iframes.

Code:
<meta http-equiv="X-Frame-Options" content="SAMEORIGIN">

5. Prevent Cross-Site Scripting (XSS)
Escape all user input. Use the sanitize and escape functions in your code. In HTML forms, you can enforce proper input validation:

Code:
<input type="text" name="username" required pattern="[a-zA-Z0-9]{5,20}" title="Only alphanumeric characters, 5-20 characters long.">

6. Prevent MIME-Type Sniffing
Ensure that browsers only interpret files as their declared content type.

Code:
<meta http-equiv="X-Content-Type-Options" content="nosniff">

7. Use Secure Cookies
Set secure flags on cookies to prevent interception during transmission.

Code:
setcookie("user", "value", ["secure" => true, "httponly" => true, "samesite" => "Strict"]);

8. Implement Form CSRF Protection
Use a hidden token field to validate form submissions:

Code:
<input type="hidden" name="csrf_token" value="your_token_here">

9. Restrict Directory Access
Ensure no sensitive files or directories are exposed using .htaccess rules:
Options -Indexes
10. Secure Login Page with Autocomplete Off
Prevent browsers from storing sensitive data on your login form.

Code:
<form autocomplete="off">

  <input type="password" name="password" autocomplete="new-password">

</form>

Conclusion
Applying these HTML and meta tags improves your website security and protects against common threats like XSS, clickjacking, and data theft. Combine them with server-side security measures for comprehensive protection.