Why Website Security Is Non-Negotiable in India
India's Digital Personal Data Protection (DPDP) Act 2023 makes website security a legal requirement, not just best practice. Websites that collect personal data (names, emails, phone numbers, addresses) must implement "reasonable security safeguards." Failure to comply can result in penalties up to ₹250 crore. Beyond legal compliance, security breaches destroy customer trust and brand credibility.
Essential Security Headers
Strict-Transport-Security (HSTS): Force HTTPS connections and prevent downgrade attacks. Header: `max-age=63072000; includeSubDomains; preload`.
X-Content-Type-Options: nosniff: Prevent MIME-type sniffing attacks.
X-Frame-Options: DENY: Block clickjacking attacks by preventing your site from being embedded in iframes.
X-XSS-Protection: 1; mode=block: Enable browser-level XSS filtering.
Referrer-Policy: strict-origin-when-cross-origin: Control what referrer information is sent with requests.
Permissions-Policy: Disable unused browser APIs (camera, microphone, geolocation) to reduce attack surface.
Content-Security-Policy (CSP): Whitelist trusted sources for scripts, styles, images, and fonts to prevent XSS.
Authentication & Data Protection
Hash all passwords with bcrypt (cost factor 10+) — never store plaintext.
Implement rate limiting on login endpoints to prevent brute-force attacks.
Use HTTP-only, Secure, SameSite cookies for session management.
Validate and sanitize all user inputs — both client-side and server-side.
Encrypt sensitive data at rest (AES-256) and in transit (TLS 1.3).
Implement CSRF protection on all state-changing form submissions.
DPDP Act 2023 Compliance Checklist
Publish a clear, comprehensive Privacy Policy explaining what data you collect and why.
Obtain explicit consent before collecting personal data (cookie banners, form consent checkboxes).
Provide users the ability to access, correct, and delete their personal data.
Implement data retention policies — don't keep data longer than necessary.
Appoint a Data Protection Officer if processing significant volumes of personal data.
Document your data processing activities and maintain records of consent.
Production Hardening Checklist
Remove all debug logs, console.log statements, and source maps from production builds.
Disable directory listing and powered-by headers.
Keep all dependencies updated — run `npm audit` regularly.
Implement server-side rate limiting with circuit breakers and graceful fallbacks.
Set up uptime monitoring and error alerting (Sentry, Better Stack, or similar).
Use environment variables for all secrets — never commit API keys to git.
Enable DNSSEC and configure CAA records for your domain.
Key Takeaways
DPDP Act 2023 makes website security a legal requirement in India.
Security headers (HSTS, CSP, X-Frame-Options) are free and take minutes to implement.
Hash passwords with bcrypt, rate-limit login endpoints, and validate all inputs.
Publish a clear Privacy Policy and implement cookie consent.
Run regular security audits and keep dependencies updated.