Skip to content

Web Browsing Security Checklist

Intro

Most websites use some form of tracking, often in order to legitimately improve site functionality and to gain insight into users' behaviour and preferences. This data can be quite detailed, however, and so it can also be inappropriately used by corporations, governments, and intellectual property thieves. Data breaches and leaks are common, and attackers may be able to re-associate anonymous data with real users.

Here are some steps you can take to be better protected from threats, minimise online tracking, and improve your personal privacy.

Checklist

Essential Activities

  • Ensure Website is Legitimate
    Priority: Essential
    When you log into any online accounts, double check that the URL is correct. Store commonly visited sites in your bookmarks to ensure the URL is easy to find. When visiting a new websites, look for common signs that it could be unsafe: browser warnings, redirects, on-site spam, and pop-ups. You can also check a website using tools like: Virus Total, IsLegitSite, or Google Safe Browsing Status.

  • Keep Browser Up-to-date
    Priority: Essential
    Browser vulnerabilities are constantly being discovered and patched, so it's important to keep your browser up to date. You can see which browser version you're using with WhatIsMyBrowser.com, or follow this guide for instructions on how to update your browser. Some browsers will auto-update to the latest stable version.

  • Check for HTTPS
    Priority: Essential
    Any web address should begin with "https://" and not just "http:// (without an "S" to establish a secure and encrypted connection with the remote server. If you enter information on a non-HTTPS website, this data is transported unencrypted and can therefore be read by anyone who intercepts it. The "Site information" icon next to the URL should also show that the "Connection is Secure." Chrome, Safari, and most modern browsers will redirect you from http to https and will show you a warning if they can't.
    Learn more: What is HTTPS and How It Differs From HTTP

  • Remove Unnecessary Browser Addons
    Priority: Essential
    Extensions are able to see, log or modify anything you do in the browser, and some innocent-looking browser apps have malicious intentions. Only install extensions you really need, and remove those which you haven't used in a while.
    Learn more about Security Browser Extensions

  • Use Incognito
    Priority: Recommended
    When using someone else's machine, ensure that you're in a private/incognito session (Use Ctrl+Shift+N / Cmd+Shift+N / Ctrl+Shift+P -on Firefox). This will prevent the browser from saving your credentials, cookies, and browsing history.

  • Use a Privacy-Respecting Browser
    Priority: Recommended
    Use a privacy-respecting browser such as: Firefox, Brave, or DuckDuckGo.
    Review a comparison of Privacy Browsers.

  • Compartmentalize with Web Containers/Profiles
    Priority: Recommended
    Compartmentalisation is really important to keep different aspects of your browsing separate. For example, using different profiles for work, general browsing, social media, and online shopping will reduce the number of associations that data brokers can link back to you. One option is to use Firefox Containers or Chrome profiles which are designed exactly for this purpose. Alternatively, you could use different browsers for different tasks (Brave, Firefox, Vivaldi browser, Opera, Tor, etc).

  • Avoid Creating "Click Here" Links
    Priority: Recommended
    When you are creating links in your newsletters or on the DA Website, show visitors the link, or website, where you are actually sending them by using the real address in your message – avoid using "Click Here" text.
    Your members should be able to see where you are sending them – this builds trust and familiarity with the sites you are referencing.

  • Manage Cookies
    Priority: Recommended
    Clearing cookies regularly is one step you can take to help reduce websites from tracking you. Cookies may also store your session token, which if captured, would allow someone to access your accounts without credentials. To mitigate this you should clear cookies often.

  • Block Third-Party Trackers
    Priority: Recommended
    Blocking trackers will help to stop websites, advertisers, analytics and more from tracking you in the background. Privacy Badger, DuckDuckGo Privacy Essentials, and uBlock Origin are all very effective, open source tracker-blockers available for all major browsers. (see: Privacy Browser Extensions)
    Caution, however, some cookie blockers can prevent a website from working correctly. If a legitimate site doesn't seem to work properly, or doesn't allow you to login, then try turning off any ad / cookie / tracking blockers to see if that fixes the problem.

  • Watch out for Browser Malware
    Priority: Recommended
    Your system or browser can be compromised by spyware, miners, browser hijackers, malicious redirects, adware etc. You can usually stay protected by: ignoring pop-ups, being wary of what you're clicking, and not proceeding to a website if your browser warns you it may be malicious.

  • Do Not Sign Into Your Browser
    Priority: Recommended
    Many browsers allow you to sign in to sync history, bookmarks and other browsing data across devices. However, this not only allows for further data collection, but also increases attack surface by providing another avenue for a malicious actor to access personal information.

Advanced Activities

  • Beware of Redirects
    Priority: Advanced
    While some redirects are harmless, unvalidated redirects are used in phishing attacks to make a malicious link seem legitimate. If you are unsure about a redirect URL, you can check where it forwards to with a tool like RedirectChecker.

  • Disable Automatic Downloads
    Priority: Advanced
    Drive-by downloads are a common method of getting harmful files onto a user's device. This can be mitigated by disabling auto file downloads, and being cautious of websites which prompt you to download files unexpectedly.

  • Disallow Access to Sensors
    Priority: Advanced
    Mobile websites can tap into your device sensors without asking. If you grant these permissions to your browser once, then all websites are able to use these capabilities without further permission or notification.

  • Disallow Location
    Priority: Advanced
    Location Services lets sites ask for your physical location. This should be disabled in browser settings. Note that there are still other methods of determining your approximate location.

  • Disallow Camera/Microphone Access
    Priority: Advanced
    Check browser settings to ensure that no websites are granted access to your webcam or microphone. It may also be beneficial to use physical protection such as a webcam cover and microphone blocker.

  • Disable Browser Password Saves
    Priority: Advanced
    Do not allow your browser to store usernames and passwords, as these can be easily viewed or accessed. Use a dedicated Password Manager instead.

  • Disable Browser Autofill
    Priority: Advanced
    Turn off autofill for any confidential or personal details. This feature can be harmful if your browser is compromised in any way. Instead, consider using your password manager's Notes feature.