# The Website Specification — checklist (17 items)

## Security
- [ ] **HTTPS and TLS** _(required)_ — Serve every page over HTTPS using TLS 1.2 or 1.3, redirect plain HTTP to HTTPS, and disable obsolete SSL and early TLS versions on every host you control.
      https://specification.website/spec/security/https-tls/
- [ ] **HSTS (Strict-Transport-Security)** _(required)_ — HSTS tells browsers to only ever use HTTPS for your domain. Send max-age with includeSubDomains — but skip the preload list, which its own operator now discourages.
      https://specification.website/spec/security/hsts/
- [ ] **Mixed content and upgrade-insecure-requests** _(recommended)_ — An HTTPS page that loads any subresource over HTTP is mixed content. Serve every subresource over HTTPS, and send the upgrade-insecure-requests CSP directive as a safety net.
      https://specification.website/spec/security/mixed-content/
- [ ] **Content Security Policy (CSP)** _(recommended)_ — A CSP tells browsers which sources of script, style, image, and frame content to trust. A good policy stops most XSS and data-exfiltration attacks dead.
      https://specification.website/spec/security/content-security-policy/
- [ ] **Reporting API (Reporting-Endpoints)** _(recommended)_ — A response header that names HTTP endpoints to which the browser POSTs structured violation reports — CSP and COOP breaches, permissions-policy violations, deprecations, interventions, and crashes — so you learn what is breaking in the field.
      https://specification.website/spec/security/reporting-endpoints/
- [ ] **/.well-known/security.txt** _(recommended)_ — A standard text file at /.well-known/security.txt tells security researchers how to report vulnerabilities. It is cheap to publish and dramatically lowers the bar for responsible disclosure.
      https://specification.website/spec/security/security-txt/
- [ ] **X-Content-Type-Options: nosniff** _(required)_ — The nosniff header stops browsers from guessing a response's content type. It blocks a class of attacks where a benign-looking file is interpreted as script or stylesheet.
      https://specification.website/spec/security/x-content-type-options/
- [ ] **Clickjacking protection (frame-ancestors / X-Frame-Options)** _(required)_ — Tell browsers who is allowed to embed your pages in an iframe. Use CSP frame-ancestors. X-Frame-Options is the legacy fallback.
      https://specification.website/spec/security/frame-ancestors/
- [ ] **Cross-origin isolation (COOP / COEP / CORP)** _(recommended)_ — Three response headers — Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy, and Cross-Origin-Resource-Policy — that sever risky cross-window and cross-origin links and defend against side-channel leaks.
      https://specification.website/spec/security/cross-origin-isolation/
- [ ] **Referrer-Policy** _(recommended)_ — Referrer-Policy controls how much URL information your site leaks when users follow a link or load a subresource. strict-origin-when-cross-origin is the sensible default.
      https://specification.website/spec/security/referrer-policy/
- [ ] **Permissions-Policy** _(recommended)_ — Permissions-Policy lets you turn off powerful browser features — camera, microphone, geolocation, payment, USB — for your own pages and for any iframes you embed.
      https://specification.website/spec/security/permissions-policy/
- [ ] **Subresource Integrity (SRI)** _(recommended)_ — SRI adds a cryptographic hash to every third-party script and stylesheet so the browser refuses to run modified files. Essential for any external JS or CSS you depend on.
      https://specification.website/spec/security/subresource-integrity/
- [ ] **Trusted Types** _(recommended)_ — Trusted Types make the browser reject plain strings at DOM injection sinks like innerHTML, demanding a vetted typed value instead. Switched on with two CSP directives, it neutralises a whole class of DOM-based XSS.
      https://specification.website/spec/security/trusted-types/
- [ ] **Cookie attributes — Secure, HttpOnly, SameSite** _(required)_ — Every cookie should be Secure, HttpOnly where possible, and have an explicit SameSite. Use __Host- and __Secure- prefixes for session cookies.
      https://specification.website/spec/security/cookie-attributes/
- [ ] **Clear-Site-Data** _(optional)_ — Clear-Site-Data lets a response tell the browser to wipe cookies, storage, and caches for your origin. Send it on logout so a shared device keeps nothing behind.
      https://specification.website/spec/security/clear-site-data/
- [ ] **DNS CAA records** _(recommended)_ — A CAA record tells certificate authorities which of them are allowed to issue certificates for your domain. Cheap to add, blocks a class of mis-issuance attacks.
      https://specification.website/spec/security/caa-records/
- [ ] **DNSSEC** _(optional)_ — DNSSEC cryptographically signs DNS records so resolvers can verify they have not been tampered with. Strong defence in depth, but only with full registrar and registry support.
      https://specification.website/spec/security/dnssec/