Safe and secure

Understand security basics

• Security should not be so scary!

• What are security attacks?

• Understanding "same-site" and "same-origin"

• Security headers quick reference

Secure connections with HTTPS

• Why HTTPS matters

• Enabling HTTPS on your servers

• What is mixed content?

• Fixing mixed content

• When to use HTTPS for local development

• How to use HTTPS for local development

Prevent info leaks

• Browser sandbox

• Same-origin policy

• Cross-Origin Resource Sharing (CORS)

• Making your website "cross-origin isolated" using COOP and COEP

• Why you need "cross-origin isolated" for powerful features

• Protect your resources from web attacks with Fetch Metadata

Protect websites from XSS

• Prevent DOM-based cross-site scripting vulnerabilities with Trusted Types

• Mitigate cross-site scripting (XSS) with a strict Content Security Policy (CSP)

• Securely hosting user data in modern web applications

Monitor security violations and deprecations

• Reporting API open_in_new

• Migrate to Reporting API v1 open_in_new

• Network Error Logging (NEL)

Cookies

• Understanding cookies

• Prepare for third-party cookie deprecation on Chrome open_in_new

• SameSite cookies explained

• SameSite cookie recipes

• First-party cookie recipes

• Referer and Referrer-Policy best practices

• Schemeful Same-Site

The Privacy Sandbox

• Discover Privacy Sandbox open_in_new

• Private State Tokens open_in_new

• User-Agent reduction open_in_new

Get started

• Help, I think I've been hacked

• How do I know if my site was hacked?

• Build a support team

• Quarantine your site

• Use Search Console

• Assess spam damage

Common hacks

• Top ways sites get hacked by spammers

• Fixing the Japanese Keyword hack

• Fixing the gibberish hack

• Fixing the cloaked keywords and links hack

• Hacked with malware

Fix the problem

• Identify the vulnerability

• Clean and maintain your site

• Request a review

• Glossary for hacked sites

• FAQ for hacked sites