In general, browsers default security policy force a valid “https” connection to allow access to even the most rudimentary functionality. Admittedly SSL doesn

In general, browsers default security policy force a valid “https” connection to allow access to even the most rudimentary functionality. Admittedly SSL doesn’t stop every issue, especially considering the number of times issuers were caught signing bogus content (Symantec, Microsoft, and so on…). However, it does narrow the number of variables when tracking down 3rd party issues like ISPs fiddling with content. 1. disable crossorigin on your server if you can manage without.. 2. hash sign static included javaScript and CSS files (for CDN services this is good practice): cat file.js | openssl dgst -sha384 -binary | openssl base64 -A In your html/script add content include tag check: ... script src="file.js" integrity="theHash" … 3. Force re-encode of media in a temporary VM instance: strips all user media files of non-media data/metadata to protect people from themselves, mitigates adversarial nuisances, and ensures format conforms to a known standard. 4. DNS over HTTPS (DoH) is an option now, and recommended in many cases 5. DNS Security Extensions (DNSSEC) can be a huge resource drain for high-traffic sites.. YMMV.. sometimes a necessary evil to turn it off.. 6. Should one ever allow users to upload compressed archives, unidentified binaries, webp, SVG, fonts, or TIFF? https://www.youtube.com/watch?v=pmePLg3hdCw https://www.youtube.com/watch?v=pmePLg3hdCw 7. Sanitize your input data with standard filters, and never trust the input content.. even your own (both client and server side checking of data). 8. Traffic shaping firewall to force dropping clients outside a "normal" traffic service range/session-time. 9. Interface transaction quota limit tripwire, and firewall service abuse breaker logic This is hardly an exhaustive list, but will often reduce common nuisances. ;-)