Web best Practices

Whether they are automated on DareBoost.com or not , find in details the best practices of web performance and quality. This area is also yours, don’t hesitate to suggest us a post of your own, or a topic you would like us to write about.

Ensure secured connections with HSTS (HTTP Strict Transport Security)

Our regular readers already know that HTTPS is now a requirement for any websites. The urge to get rid of unsecured navigation has never been stronger: each release of Google Chrome or Mozilla Firefox comes with a new warning sign for users sharing private data. Soon, all forms will be concerned.

But offering an HTTPS version of your website is not enough to automatically redirect all your HTTP traffic to this secured version. Continue reading

Secure your cookies to the next level with SameSite attribute

After reading our last article about how to secure your cookies, you may (should?) already be using Secure and HttpOnly flags. As a reminder, ‘Secure’ allows to prevent a cookie to be sent on a non-secure web page, whereas ‘HttpOnly’ prevents any client-side usage of a given cookie.
It is now time to take your website security to the next level with one more attribute for your cookies! Let’s talk about SameSite instruction, allowing to prevent Cross-Site Request Forgery (CSRF) attacks and Cross-Site Script Inclusion (XSSI). Continue reading

Performance and security of target=_blank links with rel=noopener

About one year ago, we were announcing an update of the quality checkpoints of our website analysis service. This update was including a new best practice related to hypertext links opening in a new window or tab by using target=”_blank” attribute.
Joining Google Chrome, the latest Firefox version now supports the rel=”noopener” attribute, which was one of our advised solutions. The right time for us to have a look back on this recommendation we have brought not only for better security but also for web performance. Continue reading

On the way to HTTP/2: what to expect for front-end development?

We have announced it a couple months ago: our web performance testing tool now fully supports HTTP/2 and our best practices repository has been updated to handle the particularities of this new protocol. Now, let’s go back to the reasons of HTTP/2 emergence and talk about the major changes this protocol brings, and these old HTTP/1 best practices that we will have to give up! Continue reading

Why you should avoid using document.write, specifically for scripts injection

Web performance testing tools like Google Page Speed or Dareboost already pointed it: injecting a script by using document.write instruction causes severe issues about websites loading time. Let’s talk about this topic one more time, as the next Chrome update to come won’t allow such scripts injections any longer. What kind of issues may you experience? Which alternatives to find?

Continue reading