A checklist for securing websites and domains

HSTS, CAA, SPF…

Posted: Monday, 6 March 2023

I've compiled below the things I've done to secure this site and domain. These lists do not include software and configuration for other applications on the server.

Websites #

Use HTTPS to encrypt web content in transit. Obtain free TLS certificates from LetsEncrypt [1].
Listen on port 80 and forward to port 443.
Disable TLSv1.0 and TLSv.1.1, as they are outdated [2].
Send the HSTS header: A web server header that tells browsers to always use HTTPS [3]. The browser must either receive the HSTS header from the site or see the domain on the HSTS preload list.
Get on the HSTS preload list: An opt-in list of domains distributed to browsers to tell them to always use HTTPS [4].
Configure server to send response headers as recommended by the OWASP Secure Headers Project [5]. You can check which of them are configured using a tool like Geekflare [6].
Install, enable, and configure a Web Application Firewall (WAF), like ModSecurity [7] with the OWASP Core Rule Set [8]. WAFs inspect HTTP server traffic and can use rules and heuristics to deny suspicious traffic.
Disable autoindexing: prevent your web server from automatically generating directory listings for directories that don't have an index file [9] [10].

DNS configuration #

Create a CAA record to indicate which certificate authorities are authorised to issue certificates for your domain [11].
- Note: Cloudflare may automatically add CAA records so that it can serve reverse-proxied sites [12].
Email
- Add a Sender Policy Framework (SPF) record to indicate which senders are allowed to send mail on behalf of a domain. [13]
- Configure DomainKeys Identified Mail (DKIM). Digital signatures prove that an email was sent by a sender authorised by the domain (or at least that the sender has the private key). DKIM keys are stored as TXT, but a CNAME record can be created to point to the actual DKIM key. [14]
- Use DKIM key rotation: Mitigate the damage attackers can cause by cracking or stealing the private key by changing it every so often [15].
- Add a DMARC record to indicate what mail servers should do if they receive an email purportedly from your domain that fails SPF and/or DKIM alignment [16]. Indicate the email address where alerts of messages failing alignment should be sent to by setting rua [17].
- If you're using OpenPGP, add a CNAME record for openpgpkey that points to a key server where public keys can be found for email addresses at your domain [18].

Service-specific configuration items #

Cloudflare reverse proxy settings
- Set the Encryption mode to Full (strict) [19].
- Enable Always use HTTPS.
- Enable HSTS headers [3].
- Set the minimum TLS version to 1.2 [2].
Netlify
- Add the OWASP Secure Headers Project-recommended headers using _headers or netlify.toml [20]