Security

Web security is the practice of protecting websites and their users from damage caused by malicious third parties, who are generally called attackers.

The kind of damage done can be reputational, financial, or even physical. It can target data that should be kept private to users, or actions that should be only made available to particular users. The motivations of attackers might be financial, political, or personal.

In this part of MDN we've written guides to help web developers understand how to protect their websites, and their users, against these attacks.

The documentation is organized into four main sections:

• Attacks
• Defenses
• Threat modeling
• Authentication

In this page we'll introduce each of these sections and list the guides they contain. First though, we'll list the core security practices that web developers should follow.