Security standards
Standards for protecting your website and its users from online threats.
| Indicators | Standard | Why | Guidance |
|---|---|---|---|
The site has a policy that limits what external content can load on its pages. | Helps stop hackers by blocking harmful code from running on your website. | ||
The site forces an encrypted HTTPS connection for all users. | Forces secure connections, protecting user data by making websites always load with encryption. | ||
The site has a security.txt file so researchers know how to report issues. | Provides contact info for reporting security issues, helping site owners fix problems quickly and keep users safe. | ||
The site tells browsers not to guess the type of files it serves. | Stops browsers from guessing file types, helping prevent security risks by enforcing correct content handling. | ||
The page loads without JavaScript or network errors. | Signals problems in website code, helping developers fix issues that could affect how the site works or displays. | ||
The site prevents other websites from embedding its pages to trick users into clicking. | Prevents malicious websites from tricking users into clicking hidden elements, enhancing site security and protecting user actions. | ||
The page lets users paste content into form fields. | Negatively impacts user experience and weakens security by blocking password managers. | ||
The site uses HTTPS to encrypt data between the server and users. | Secures data by encrypting communication, protecting user privacy and preventing unauthorized access to sensitive information during online interactions. | ||
The site uses a government-issued domain (.gov, .edu, or .mil). | Defines trusted website categories, helping users identify official sites and improving credibility and security for specific organizations. |