Let's say I want to host a public website, for use by anyone on the internet. I am deliberately leaving the exact nature of the website vague, because I want to ask for general things that are applicable to any person serving HTML over the public internet.

What security best practices should be followed by anyone hosting such a website? Note that I'm asking for general things. So, for example, "hash the passwords of your users in the DB" should not be part of the answer because not all sites have user accounts. But "disable obsolete HTTPS cyphers" can be part of an answer; even though not all sites are HTTP, the majority these days are, and there is rarely a reason to support known-vulnerable cyphers.

To make things more specific:

• The website serves HTML. The HTML is likely contain JS and CSS. Some files may be served, such as JPG, PNG, GIF, TXT, PDF, video or audio - but always as direct links and never with a file browser.
• You can assume no REST API, websocket or other non-web technology is used. You can also disregard any databases.
• The HTML may be static, or it may be generated dynamically server-side with eg. WSGI.
• The site is accessible by the public internet.
• Anyone can browse the site. There can be no restriction on users (such as requiring visitors to be on a VPN).
• The host machine is fully dedicated to the website, there are no other services that share it, and no data on the server that is unrelated to host the website.
• You can assume that https://caddyserver.com/ acts as a reverse proxy in front of the server, and introduces TLS.
• You can assume the website uses HTTPS.
• The web admin is individual who is maintaining it in his free time, not a full-time team of professional sysadmins at a large company.

posted over 1 year ago

CC BY-SA 4.0

matthewsnyder‭

141 82 73