mdn · chrisdavidmills · May 28, 2024 · May 28, 2024 · May 28, 2024 · May 28, 2024
@@ -3992,7 +3992,7 @@
 /en-US/docs/HTTP_Pipelining_FAQ /en-US/docs/Web/HTTP/Connection_management_in_HTTP_1.x
 /en-US/docs/HTTP_Transaction_Model /en-US/docs/Web/HTTP
 /en-US/docs/HTTP_access_control /en-US/docs/Web/HTTP/CORS
-/en-US/docs/How_to_Turn_Off_Form_Autocompletion /en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion
+/en-US/docs/How_to_Turn_Off_Form_Autocompletion /en-US/docs/Web/Security/Practical_implementation_guides/Turning_off_form_autocompletion
 /en-US/docs/How_to_check_the_security_state_of_an_XMLHTTPRequest_over_SSL /en-US/docs/Web/API/XMLHttpRequest
 /en-US/docs/How_to_create_a_DOM_tree /en-US/docs/Web/API/Document_Object_Model/How_to_create_a_DOM_tree
 /en-US/docs/How_to_start_contributions_to_Mozilla /en-US/docs/MDN/Community/Contributing/Getting_started
@@ -6795,7 +6795,7 @@
 /en-US/docs/Security/MixedContent/fix_website_with_mixed_content /en-US/docs/Web/Security/Mixed_content/How_to_fix_website_with_mixed_content
 /en-US/docs/Security/Mixed_content /en-US/docs/Web/Security/Mixed_content
 /en-US/docs/Security/Mixed_content/How_to_fix_website_with_mixed_content /en-US/docs/Web/Security/Mixed_content/How_to_fix_website_with_mixed_content
-/en-US/docs/Security/Securing_your_site /en-US/docs/Web/Security/Securing_your_site
+/en-US/docs/Security/Securing_your_site /en-US/docs/Web/Security/Practical_implementation_guides
 /en-US/docs/Security/Weak_Signature_Algorithm /en-US/docs/Web/Security/Weak_Signature_Algorithm
 /en-US/docs/Security_changes_in_Firefox_3.1 /en-US/docs/Mozilla/Firefox/Releases/3.5/Security_changes
 /en-US/docs/Security_changes_in_Firefox_3.5 /en-US/docs/Mozilla/Firefox/Releases/3.5/Security_changes
@@ -13024,7 +13024,9 @@
 /en-US/docs/Web/Security/Do_not_track_field_guide/Tutorials/Additional_resources /en-US/docs/Web/HTTP/Headers/DNT
 /en-US/docs/Web/Security/HTTP_strict_transport_security /en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
 /en-US/docs/Web/Security/Public_Key_Pinning /en-US/docs/Web/Security/Certificate_Transparency
+/en-US/docs/Web/Security/Securing_your_site /en-US/docs/Web/Security/Practical_implementation_guides
 /en-US/docs/Web/Security/Securing_your_site/Configuring_server_MIME_types /en-US/docs/Learn/Server-side/Configuring_server_MIME_types
+/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion /en-US/docs/Web/Security/Practical_implementation_guides/Turning_off_form_autocompletion
 /en-US/docs/Web/WebGL /en-US/docs/Web/API/WebGL_API
 /en-US/docs/Web/WebGL/Adding_2D_content_to_a_WebGL_context /en-US/docs/Web/API/WebGL_API/Tutorial/Adding_2D_content_to_a_WebGL_context
 /en-US/docs/Web/WebGL/Animating_objects_with_WebGL /en-US/docs/Web/API/WebGL_API/Tutorial/Animating_objects_with_WebGL

@@ -126947,6 +126947,72 @@
  "dbruant"
  ]
  },
+ "Web/Security/Practical_implementation": {
+ "modified": "2020-06-03T13:43:23.202Z",
+ "contributors": [
+ "jswisher",
+ "mfuji09",
+ "germain",
+ "sideshowbarker",
+ "patizenyapetshop",
+ "larsonreever",
+ "SebastienParis",
+ "tlubitz",
+ "david_ross",
+ "mbm",
+ "chrisdavidmills",
+ "JazibZaman",
+ "hashedhyphen",
+ "marumari",
+ "evilpie",
+ "Sheppy",
+ "teoli"
+ ]
+ },
+ "Web/Security/Practical_implementation/Turning_off_form_autocompletion": {
+ "modified": "2020-07-10T21:28:54.938Z",
+ "contributors": [
+ "patrickhlauke",
+ "mfuji09",
+ "mnoorenberghe",
+ "leela52452",
+ "jswisher",
+ "sruthiveeragandham",
+ "Nomeh_Uchenna_Gabriel",
+ "mfluehr",
+ "WilliamC07",
+ "hjuhlin",
+ "chrisdavidmills",
+ "LouisLazaris",
+ "devinea2",
+ "steduardo",
+ "terrylinooo",
+ "kbagot",
+ "stutrek",
+ "Didglee",
+ "rottina",
+ "Delapouite",
+ "wbamberg",
+ "John99",
+ "Manishearth",
+ "Sheppy",
+ "ConcreteGannet",
+ "teoli",
+ "contrebis",
+ "dhodder",
+ "David-Sarah Hopwood",
+ "George3",
+ "LonelyPixel",
+ "Brianegge",
+ "NickolayBot",
+ "Andreas Wuest",
+ "Brycenesbitt",
+ "Callek",
+ "VicMan",
+ "Pmsyyz",
+ "Mathieu Deaudelin"
+ ]
+ },
  "Web/Security/Referer_header:_privacy_and_security_concerns": {
  "modified": "2020-07-22T14:05:46.803Z",
  "contributors": [
@@ -127051,72 +127117,6 @@
  "Annevk"
  ]
  },
- "Web/Security/Securing_your_site": {
- "modified": "2020-06-03T13:43:23.202Z",
- "contributors": [
- "jswisher",
- "mfuji09",
- "germain",
- "sideshowbarker",
- "patizenyapetshop",
- "larsonreever",
- "SebastienParis",
- "tlubitz",
- "david_ross",
- "mbm",
- "chrisdavidmills",
- "JazibZaman",
- "hashedhyphen",
- "marumari",
- "evilpie",
- "Sheppy",
- "teoli"
- ]
- },
- "Web/Security/Securing_your_site/Turning_off_form_autocompletion": {
- "modified": "2020-07-10T21:28:54.938Z",
- "contributors": [
- "patrickhlauke",
- "mfuji09",
- "mnoorenberghe",
- "leela52452",
- "jswisher",
- "sruthiveeragandham",
- "Nomeh_Uchenna_Gabriel",
- "mfluehr",
- "WilliamC07",
- "hjuhlin",
- "chrisdavidmills",
- "LouisLazaris",
- "devinea2",
- "steduardo",
- "terrylinooo",
- "kbagot",
- "stutrek",
- "Didglee",
- "rottina",
- "Delapouite",
- "wbamberg",
- "John99",
- "Manishearth",
- "Sheppy",
- "ConcreteGannet",
- "teoli",
- "contrebis",
- "dhodder",
- "David-Sarah Hopwood",
- "George3",
- "LonelyPixel",
- "Brianegge",
- "NickolayBot",
- "Andreas Wuest",
- "Brycenesbitt",
- "Callek",
- "VicMan",
- "Pmsyyz",
- "Mathieu Deaudelin"
- ]
- },
  "Web/Security/Subdomain_takeovers": {
  "modified": "2020-08-25T23:27:57.222Z",
  "contributors": ["jswisher"]

@@ -494,8 +494,8 @@ To prevent referrer leakage entirely, specify the `no-referrer` value instead. N
 
 Use services like the ones below to check your `Referrer-Policy`:
 
+- [MDN Observatory](/en-US/observatory/)
 - [securityheaders.com](https://securityheaders.com/)
-- [Mozilla Observatory](https://observatory.mozilla.org/)
 
 ```apacheconf
 <IfModule mod_headers.c>

@@ -181,7 +181,7 @@ The next and final step in this module about Django is to complete the [assessme
 ## See also
 
 - [Security in Django](https://docs.djangoproject.com/en/5.0/topics/security/) (Django docs)
-- [Server side website security](/en-US/docs/Web/Security) (MDN)
-- [Securing your site](/en-US/docs/Web/Security/Securing_your_site) (MDN)
+- [Security on the web](/en-US/docs/Web/Security) (MDN)
+- [Practical security implementation guides](/en-US/docs/Web/Security/Practical_implementation_guides) (MDN)
 
 {{PreviousMenuNext("Learn/Server-side/Django/Deployment", "Learn/Server-side/Django/django_assessment_blog", "Learn/Server-side/Django")}}
@@ -50,7 +50,7 @@ The attribute value is either the keyword `off` or `on`, or a space-separated `<
 
  - : The browser is not permitted to automatically enter or select a value for this field. It is possible that the document or application provides its own autocomplete feature, or that security concerns require that the field's value not be automatically entered.
 
- > **Note:** In most modern browsers, setting `autocomplete` to "`off`" will not prevent a password manager from asking the user if they would like to save username and password information, or from automatically filling in those values in a site's login form. See [the autocomplete attribute and login fields](/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion#the_autocomplete_attribute_and_login_fields).
+ > **Note:** In most modern browsers, setting `autocomplete` to "`off`" will not prevent a password manager from asking the user if they would like to save username and password information, or from automatically filling in those values in a site's login form. See [the autocomplete attribute and login fields](/en-US/docs/Web/Security/Practical_implementation/Turning_off_form_autocompletion#the_autocomplete_attribute_and_login_fields).
 
 - `on`
 
@@ -86,7 +86,7 @@ The attribute value is either the keyword `off` or `on`, or a space-separated `<
  - "`username`"
  - : A username or account name.
  - "`new-password`"
- - : A new password. When creating a new account or changing passwords, this should be used for an "Enter your new password" or "Confirm new password" field, as opposed to a general "Enter your current password" field that might be present. This may be used by the browser both to avoid accidentally filling in an existing password and to offer assistance in creating a secure password (see also [Preventing autofilling with autocomplete="new-password"](/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion#preventing_autofilling_with_autocompletenew-password)).
+ - : A new password. When creating a new account or changing passwords, this should be used for an "Enter your new password" or "Confirm new password" field, as opposed to a general "Enter your current password" field that might be present. This may be used by the browser both to avoid accidentally filling in an existing password and to offer assistance in creating a secure password (see also [Preventing autofilling with autocomplete="new-password"](/en-US/docs/Web/Security/Practical_implementation/Turning_off_form_autocompletion#preventing_autofilling_with_autocompletenew-password)).
  - "`current-password`"
  - : The user's current password.
  - "`one-time-code`"

@@ -36,7 +36,7 @@ This element includes the [global attributes](/en-US/docs/Web/HTML/Global_attrib
 
  - : Indicates whether input elements can by default have their values automatically completed by the browser. `autocomplete` attributes on form elements override it on `<form>`. Possible values:
 
- - `off`: The browser may not automatically complete entries. (Browsers tend to ignore this for suspected login forms; see [The autocomplete attribute and login fields](/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion#the_autocomplete_attribute_and_login_fields).)
+ - `off`: The browser may not automatically complete entries. (Browsers tend to ignore this for suspected login forms; see [The autocomplete attribute and login fields](/en-US/docs/Web/Security/Practical_implementation/Turning_off_form_autocompletion#the_autocomplete_attribute_and_login_fields).)
  - `on`: The browser may automatically complete entries.
 
 - `name`

@@ -72,8 +72,7 @@ X-Content-Type-Options: nosniff
 
 - {{HTTPHeader("Content-Type")}}
 - The [original definition](https://docs.microsoft.com/archive/blogs/ie/ie8-security-part-vi-beta-2-update) of X-Content-Type-Options by Microsoft.
-- The [Mozilla Observatory](https://observatory.mozilla.org/) tool testing
- the configuration (including this header) of websites for safety and security
+- Use [MDN Observatory](/en-US/observatory/) to test the security configuration of websites (including this header).
 - [Mitigating MIME Confusion Attacks in Firefox](https://blog.mozilla.org/security/2016/08/26/mitigating-mime-confusion-attacks-in-firefox/)
 - [Cross-Origin Read Blocking (CORB)](https://fetch.spec.whatwg.org/#corb)
 - [Google Docs CORB explainer](https://chromium.googlesource.com/chromium/src/+/master/services/network/cross_origin_read_blocking_explainer.md)