← Web Application Security (OWASP) learning pathWeb Application Security (OWASP) · Module 7 of 10
Security misconfiguration
Ship secure defaults and settings.
📖 Key ideas
- Turn off debug mode and detailed errors in production.
- Remove default accounts and sample apps.
- Set security headers: CSP, HSTS, X-Content-Type-Options, frame-ancestors.
- Lock down cloud storage and admin panels.
- Automate configuration checks in CI.
💡 Real-life example: Misconfiguration is leaving the shop's back door unlocked even though the front has a great lock.
Debug modeDetailed errors for developers
Security headersHTTP headers improving browser security
Default credentialsFactory usernames/passwords
HardeningReducing attack surface