Security

Security metrics are vital for ensuring that your website is not only functional and high-performing but also safe for users. A secure website protects user data, maintains trust, and avoids vulnerabilities that could lead to data breaches, attacks, or compromised performance. While security isn't directly tied to speed or user experience metrics, it is an essential component of the overall health and integrity of your site. Security issues can also impact search engine rankings and the credibility of your platform. Below are some key security areas that Lighthouse evaluates, helping ensure your site meets modern security standards.

HTTPS Implementation

One of the most fundamental security measures for any website is serving all content over HTTPS. HTTPS encrypts the data exchanged between your server and the user's browser, protecting sensitive information such as login credentials, payment data, and personal details. Lighthouse checks for full HTTPS implementation across all resources, including images, scripts, and stylesheets. Sites that serve mixed content (a combination of HTTPS and HTTP resources) are flagged, as this can compromise the overall security of the site.

Content Security Policy (CSP)

A Content Security Policy (CSP) helps prevent cross-site scripting (XSS) attacks by specifying which content sources are allowed to load on your website. CSP acts as a security layer that restricts what can be executed in a browser, reducing the risk of malicious code execution. Lighthouse audits whether your site implements a proper CSP and suggests improvements to tighten security.

Secure Cross-Origin Requests

Cross-origin resource sharing (CORS) policies dictate how resources from different origins (domains) are shared and loaded. Improperly configured CORS policies can expose your site to unauthorized data access or attacks. Lighthouse checks that your CORS headers are securely implemented to prevent unauthorized access to resources and user data.

Avoiding Vulnerable JavaScript Libraries

Using outdated or vulnerable JavaScript libraries can expose your site to security threats. Lighthouse audits your codebase to identify libraries with known vulnerabilities and recommends updating them to the latest versions. Regularly updating libraries helps keep your site protected from attacks like code injection or remote code execution.

Avoiding Mixed Content

Mixed content occurs when a page served over HTTPS includes some resources served over HTTP, which undermines the security of the entire page. Lighthouse flags any instances of mixed content and recommends serving all resources over HTTPS. Ensuring all elements of your page are loaded securely protects against interception and tampering by malicious actors.

Browser Security Features

Modern browsers offer various security features, such as preventing outdated browser APIs or features that can compromise user safety. Lighthouse audits your site to ensure you're using secure browser APIs and avoiding deprecated or insecure features, reducing potential vulnerabilities that attackers can exploit.

XSS Protection and Input Validation

Cross-Site Scripting (XSS) attacks occur when malicious scripts are injected into web pages and executed in users’ browsers. Lighthouse checks for common vulnerabilities that can lead to XSS, such as unvalidated or unsanitized input fields. Implementing strong input validation and using security headers like X-XSS-Protection help mitigate the risks of XSS attacks.

Correct Form Handling

Lighthouse ensures that sensitive form data, such as passwords and payment information, is securely handled. It flags any form elements that lack proper attributes, such as the absence of secure password inputs or missing autocomplete attributes. Secure form handling ensures that user data is protected during submission and processing.