<story><title>Simple ways to improve the security of a web app</title><url>http://blog.fiesta.cc/post/13896457582/three-simple-ways-to-improve-the-security-of-your-web</url></story><parent_chain></parent_chain><comment><author>mike-cardwell</author><text>Your Strict-Transport-Security definition is missing the &quot;includeSubDomains&quot; flag. STS is a lot more effective if you use that flag.&lt;p&gt;You should discuss how X-Frame-Options prevents sites legitimately loading your pages inside frames too. I believe Reddit does this amongst others in order to displays a small control panel at the top of the page. X-Frame-Options is appropriate for many sites, but perhaps not for blogs.&lt;p&gt;You should talk about how CSP prevents most bookmarklets from working. For example readability and instapaper. I really like CSP, but people should be made aware of this.</text></comment>
<story><title>Simple ways to improve the security of a web app</title><url>http://blog.fiesta.cc/post/13896457582/three-simple-ways-to-improve-the-security-of-your-web</url></story><parent_chain></parent_chain><comment><author>alexchamberlain</author><text>I wasn&apos;t expecting much from yet another &quot;How to secure your website...&quot; article, but those headers are completely new to me.</text></comment>