Email & Website Security: Questions and Answers
SPF, DKIM and DMARC, email headers, HTTP security headers, HTTPS, DDoS and securing a business website.
What are SPF, DKIM and DMARC?
They are DNS records that help receiving mail servers decide whether email claiming to come from your domain is genuine. SPF lists servers allowed to send for you, DKIM adds a cryptographic signature, and DMARC tells receivers what to do when checks fail and sends you reports.
Full answer and next stepsHow do I stop someone from spoofing my email domain?
Publish SPF and DKIM for every service that sends your email, then publish a DMARC record and move it in stages to p=reject once reports show legitimate mail passes. Domains that never send email should publish a strict SPF and DMARC reject policy too.
Full answer and next stepsHow do I read email headers to check if a message is fake?
Open the full message source and look at the Authentication-Results line for SPF, DKIM and DMARC results, compare the From, Reply-To and Return-Path addresses, and read the Received lines from bottom to top to see where the message really came from.
Full answer and next stepsWhat are HTTP security headers and which ones should my website have?
Security headers are instructions a website sends to the browser to turn on protections. Most sites should set Strict-Transport-Security (HSTS), a Content-Security-Policy, X-Content-Type-Options: nosniff, a Referrer-Policy and frame protection through CSP frame-ancestors or X-Frame-Options.
Full answer and next stepsHow can I check if my website is secure?
Start with a passive check of HTTPS, security headers, TLS configuration and email DNS records, then keep the CMS, plugins and server software updated, remove unused plugins and admin accounts, and protect admin logins with MFA. For apps that handle sensitive data, commission an authorized penetration test.
Full answer and next stepsWhat is a DDoS attack and how do I protect a website from one?
A distributed denial-of-service (DDoS) attack floods a website or network with traffic from many sources to make it unavailable. Small sites are best protected by putting them behind a CDN or DDoS protection service, adding rate limits, and caching as much as possible.
Full answer and next stepsHow do I secure a WordPress website?
Keep WordPress core, themes and plugins updated, delete plugins and themes you do not use, protect admin accounts with strong unique passwords and MFA, limit login attempts, take regular off-site backups, and use HTTPS with security headers.
Full answer and next stepsWhat is the OWASP Top 10?
The OWASP Top 10 is a widely used awareness list of the most critical web application security risks, such as broken access control, injection and security misconfiguration, published by the Open Worldwide Application Security Project. Teams use it to prioritize secure coding and testing.
Full answer and next stepsIs a free SSL/TLS certificate good enough for a business website?
Yes, for encryption. A free certificate from a trusted authority such as Let’s Encrypt provides the same strength of encryption as a paid domain-validated certificate. Paid options mainly add support, warranties or organization validation, which browsers no longer display prominently.
Full answer and next stepsWhat is a Content Security Policy (CSP)?
A Content Security Policy is an HTTP header that tells the browser which sources of scripts, styles, images and frames a page may load. A well-built CSP greatly reduces the impact of cross-site scripting by blocking scripts the site did not approve.
Full answer and next stepsAre SPF records public?
Yes, Sender Policy Framework (SPF) records are completely public. SPF records are published as text (TXT) records in your domain's public Domain Name System (DNS). Receiving mail servers must query your DNS records freely to confirm whether an incoming message originated from an authorized sending server or IP address. Because public DNS records are accessible to anyone on the internet, anyone can inspect your SPF configuration.
Full answer and next stepsAre HTTP headers secure when using HTTPS?
Yes, HTTP headers are encrypted in HTTPS. Transport Layer Security (TLS) encrypts the entire HTTP exchange between your browser and the web server. This protection covers request headers, response headers, cookies, and message bodies against interception and tampering by attackers on the network. However, network observers can still see the server IP address and domain name during the initial connection setup.
Full answer and next stepsGo deeper
Step-by-step articles on this subject are in the Web Security guides.