The remediation checklist

Bind credentials to a named origin instead of a wildcard so no other site can make authenticated reads

A strong Content-Security-Policy turns a script injection into a non-event

Strict-Transport-Security closes the window where a first visit gets silently downgraded to http

A one-line frame-ancestors directive tells browsers no other site may embed your pages

Check every Origin against a server-side allowlist so only sites you trust can read your API responses

The old anti-XSS header now introduces bugs, set it to 0

One nosniff header makes browsers honor the content type you declared instead of second-guessing it

One Referrer-Policy header keeps your page paths and query strings from leaking to other sites

One Permissions-Policy header denies camera, microphone, and geolocation to your page and everything it embeds

Renewing the certificate clears the browser's 'not secure' interstitial immediately, and auto-renewal keeps it gone

Serve all traffic over TLS and 301-redirect http to https so nothing a visitor sends travels in the clear

Dropping the obsolete protocol versions removes the known downgrade and decryption attacks

Replacing a self-signed certificate with a CA-issued one clears the browser's trust warning for every visitor

Reissuing the certificate so its SAN lists every hostname you serve restores the secure connection

Serve the page and its form over https so nothing a visitor types is sent in cleartext

Switching http subresources to https, with an upgrade-insecure-requests backstop, restores the padlock and stops browsers blocking half your page

Automated renewal plus expiry alerts refresh the certificate well before it can ever lapse

Lock certificate issuance to your CA and no one else

The Secure attribute tells browsers to send your session cookie only over https, so it can never be read off an unencrypted request

The HttpOnly attribute hides your session cookie from all page JavaScript, so an injected script cannot read it and steal the session

The SameSite attribute keeps your session cookie off cross-site requests, which shuts down the CSRF path

Your domain is a free phishing toolkit until you publish SPF

Monitor, then quarantine, then reject, the path to an un-spoofable domain

DKIM is the signature that survives forwarding, turn it on

Blocking /.git and rotating any committed secrets stops anyone from downloading and rebuilding your entire codebase

Rotating every credential in a public .env and removing it from the web root closes a direct line to your database and APIs

Removing a public .sql dump and moving backups off the web server stops anyone from downloading a full copy of your database

Deleting a public site archive and rotating any secrets inside it stops attackers from downloading your whole site in one file

Rotating your WordPress database credentials and salts, then removing the backup, closes a direct path into your site's data

Revoking and rotating leaked AWS access keys, then removing the file, cuts off access to your cloud account and your bill

Securing the Spring Boot actuator and rotating any secrets it printed stops your live app config from being read by anyone

Revoking the leaked npm auth token and removing the .npmrc keeps anyone from publishing packages or reading private ones as you

Rotate the exposed key and serve secrets only from the server so nothing sensitive ships to the browser

Resetting the accounts in a leaked .htpasswd and blocking the file keeps offline-cracked passwords from unlocking what they guarded

Blocking /.svn and deploying build artifacts stops anyone from reconstructing your source, secrets included.

Deleting the phpinfo page removes a full, public readout of your PHP and server configuration.

Removing a web-served compose file stops it handing out your service layout and any inline secrets.

Rotating leaked secrets and moving config out of the web root closes a plain-text path to your credentials.

Restricting mod_status to localhost stops the public watching your live requests and visitor IPs.

Gating Swagger/OpenAPI behind auth (or turning it off in production) removes a complete map of your API.

A browser API key is safe to expose only if it's restricted by domain, scope, and quota, otherwise someone else spends your budget

Binding /metrics to an internal interface stops the public reading your routes, hostnames, and traffic.

Keeping .DS_Store out of your deploy stops anyone from reading the filenames in your folders.

Validate redirect targets as internal paths so your domain can't be used to bounce visitors to phishing

Remove the dangling DNS record or reclaim the service before an attacker hosts content on your subdomain

Upgrade the flagged front-end library to a patched release and automate updates so you never drift back

Turning off auto-indexing stops the web server from handing visitors a browsable list of every file in a folder

Returning generic error pages in production stops your app from printing internal paths, queries, and versions to visitors

An integrity hash makes the browser verify every third-party script before running it, so a compromised CDN gets blocked instead of executed

Publish a security contact before you need one

Suppressing the Server version string takes your site off the easy-target list for automated exploit scans

Dropping X-Powered-By stops your responses from telling attackers which framework and version to exploit

A discovered login isn't a flaw; leaving it without rate-limiting, MFA, and secure cookies is