Security on

The Best Starter Guide for Browser Security

Fri, 21 Feb 2025 13:46:08 +0100

Useful Links
#

Virus Scanner

https://www.virustotal.com/gui/home/upload

How Secure are all the Browsers

https://privacytests.org/

Browser Sandbox

Online: https://www.browserling.com/

Selfhostet: https://www.kasmweb.com/browser-isolation

Scam Site Scanner

https://www.scamvoid.net/

Browser Fingerprinting

Browser Fingerprinting Resistence test: https://coveryourtracks.eff.org/

What Websites Know about you: https://www.deviceinfo.me/

Is your Browser Unique: https://amiunique.org/

Is your Account Login Information Puplic

https://haveibeenpwned.com/

Browser Recomendations

Tor: https://www.torproject.org/download/

Librewolf: https://librewolf.net/

Brave: https://brave.com/download/

The most secure OS for browsers ever

Whonix: https://www.whonix.org/

What is a Browser
#

Let’s start simple. What is a browser anyway? In short, it is an application that allows you to display web pages from the Internet. Nowadays, however, it is much more than that. We can save our passwords like with a password manager, we can open PDF documents in them, build applications on them etc.

In addition, we do almost everything in our browsers these days, think about how often you open your browser to do something, be it email, watch YouTube, social media, search for things, manage servers, listen to music, buy something online, etc.

It is therefore incredibly important that we protect our browsers or at least know what to protect and how secure browsers are.

Which browser should you use?
#

I know that there are several browsers and Chrome is still very popular. Nevertheless, you should know one thing, there are technically hardly any browsers. What do I mean by that? Chrome is based on a browser called Chromium, the same goes for Brave, Edge, Opera etc.

The only other unique browser is Firefox and Tor, Librewolf, MulvadBrowser, for example, are based on it.

So in the end you choose a version of Chromium or Firefox.

Of course, these browsers are customized and have features that other browsers don’t have. Brave is a good example, as it has many features for Web3, cryptocurrencies, its own Brave AI, etc.

But which browser should you use? In itself, it doesn’t really matter, but I still have a few recommendations if security and a certain degree of anonymity are important to you.

Browser Recommendations
#

The recommendations I have are all mostly Firefox based except Brave. Why is that?

The answer is simple, Chrome’s Manifest 3, which no longer allows adblockers to be used. It’s not that I hate ads but it’s still a security problem, often ad banners lead to malware sites, for a while Google had their ad links in there search engine showing malware as the first link instead of the real site.

Here is a good video of what I am talking about:

https://youtu.be/e6o2afben0s

It is therefore important to be able to use an adblocker and all browsers that I recommend can use them and have strong security on top of that without having to adjust much.

The adblocker that I recommend and many of these browsers have installed by default is Ublock Origin:

https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/

Please use it you will have a hard time downloading malware by mistake.

Librewolf Browser
#

Librewolf is a fork of Firefox. It uses Ublock by default to block ads and malware but not only that. It has incredibly good fingerprinting protection and is very lightweight. So it needs very few resources.

You can read all about it here:

https://librewolf.net/docs/features/

Download: https://librewolf.net/installation/

Tor Browser
#

Tor browser is also a fork of Firefox, but has been adapted for the Tor Protocol. There are so many articles and videos about the darknet that are absolut garbage, but that’s not the topic today.

Tor is my recommendation if you use it in combination with Whonix, Tor alone does not make you anonymous, especially if you use it on Windows or Mac. It only helps you to use the darknet or hidenservices.

So the question is what you need it for. Nevertheless, it is a fantastic browser if you want at least hide your IP.

Download Tor: https://www.torproject.org/download/

Download Whonix: https://www.whonix.org/

Brave Browser
#

Brave is special, it is Chromium based but leans heavily against Google. They even sued google once:

https://duckduckgo.com/?t=ffab&q=Brave+sues+google&ia=web

It still supports Manifest 2 and can therefore still use adblockers, and it is one of the only browsers I know that supports Web3 natively. It also has some features that may be of interest to people.

It’s not a bad browser all round, I personally just find it has too many features that I don’t need. But still it gets a full recommendation from me.

Download: https://brave.com/download/

General setting recommendations
#

There are a few things that I recommend that you should set so that you have a little more security.

Disable automatic downloading
#

When you download something, it often downloads it automatically to the Downloads folder. This is a nice thing but also bad, because websites can also start downloads without you having pressed anything.

To prevent this, you can set your browser’s download settings so that the browser always asks where to save the file.

The advantage is clear: malware can no longer simply download itself over your Browser.

Set permisions to Blockt.
#

In browsers, you can set what the browser is allowed to access. This can be the GPS position, the microphone, the camera, etc.

These should be set to Blocked. The reason is clear: if a website tries to use your microphone without permission, it will not be able to access it.

You can also add exceptions, which you can do for websites that you allow access to your Microphone etc.

Recommendations for browser analysis and security
#

We are now finished with the browsers themselves. But I still have a few recommendations for websites that you can use.

How Secure is a Browser?
#

If you ever wondered what exactly a browser protects you from, Prvacytest is a good site. It tests a number of things and lists how the browsers perform in terms of security and Anonymity.

https://privacytests.org/

Virus scanner
#

Virustotal is an online virus scanner. Of course you should not upload any sensitive data here, but if you download an exe, for example, and want to be sure that it is not malware. It is not a bad choice because it uses about 60 virus scanners so you can be sure that it recognizes the malware.

CAUTION, however, it does not always recognize everything, especially if it is new malware. So please always think about what you are downloading and doing. Virus scanners are not a thing that protects you from everything, most of the time they only protect you from things that you would avoid with common sense anyway, but more on that an other time.

https://www.virustotal.com/gui/home/upload

Browser Sandbox
#

A browser sandbox is an isolated environment from which software cannot escape. It is perfect for testing whether a site has malware or not as you can test as you like without fear of infecting your PC.

I have two recommendations here. One is online and the other one is Selfhosted.

Online: https://www.browserling.com/

Selfhostet: https://www.kasmweb.com/browser-isolation

Scam Site Database
#

Have you ever wondered if a site is just scam? On Scamvoid you can enter a URL and see if it is known for scam. This way you can quickly avoid some problems.

https://www.scamvoid.net/

Browser Fingerprinting
#

Browser fingerprinting is a complicated subject. In short, it is the ability to recognize you based on your hardware and software. It would be too much to explain here how to protect yourself, but I have a few pages where you can check your resistance and what information you give to a website and how unique your browser is.

Browser Fingerprinting Resistence test: https://coveryourtracks.eff.org/

What Websites Know about you: https://www.deviceinfo.me/

Is your Browser Unique: https://amiunique.org/

I will write an article sometime when I have time but if you are interested in the topic I recommend you to read the Whonix documentation in general, there you will learn a lot about security and how to stay Anonymous.

https://www.whonix.org/wiki/Documentation

Is your Account Login Information Puplic
#

Have you ever asked yourself. Has my account possibly been hacked? It’s good that you’re asking yourself this question, because on Have i been pwned you can quickly find out whether your account is part of a database leaked on the darknet or not. By the way, if you have been hacked, please follow this guide: https://youtu.be/HUR4QOHEurY

The most secure OS for browsers ever
#

And last but not least, the best and really one of the best operating systems if you need security.

I can hardly describe how much this OS does please read it yourself.

https://www.whonix.org/

Whonix is built specifically for Tor and is used in a VM. For all beginners I recommend to use Whonix with Virtualbox.

https://www.virtualbox.org/wiki/Downloads

If you want to learn how to use Whonix I recommend this Youtube video.

https://www.youtube.com/watch?v=nr1qpz8oNiY

Services from XenoElectronics
#

If you need help with your projects or with open source software. Take a look at our contact page and let us know what you need. We will help you to realize your projects.

https://xenoelectronics.com/contact/

Open source support & coffee fund
#

Did this guide save you hours of troubleshooting? We are happy to make this knowledge available to the community free of charge. If you would like to support our work on further open source tutorials, we would appreciate a “virtual coffee” or your support on Patreon.

Thank you for reading and for your time!

Become a Patreon supporter

Support via PayPal

Support via Stripe

If you like to share this artikel click the icons below.

Password Managers Which Should Be Used?

Sun, 09 Feb 2025 17:25:12 +0100

Useful links
#

How do Passwords work: https://www.kicksecure.com/wiki/Passwords

Local Password Manager: https://keepassxc.org

Self Hostet Password Manager: https://github.com/dani-garcia/vaultwarden

Online Hostet: https://bitwarden.com/

Passphrase generator: https://diceware.rempe.us/

What are Password Managers?
#

The question sounds stupid as the name more or less says it all, but what is a password manager?

A password manager is an application that stores passwords, user names and more and can generate passwords. It’s like an electronic notebook for all your login data.

How do they work?
#

Password managers work by creating a database where the information is stored. The database is then secured with a master password. This is required to decrypt the database.

The master password is the only thing you have to remember. This makes it easier to create different passwords for all possible accounts. This prevents you from using the same passwords over and over again.

Types of Password Managers
#

There are two types of password managers. Server based and local.

Server Solution
#

With the server-based solution, you have a central server where a user is created and all data is stored. This can be a local server or one from a provider.

The advantage is clear, because everything is stored on a server, you can access it from all end devices and changes are immediately available on all devices. The disadvantage is that it is a server and a server must be secure otherwise it could be hacked and all data can then be stolen.

Local Solution
#

The Locale solution is simply an application on your end device. It creates an encrypted file on your device where all data is stored.

The advantage may not be immediately clear. But the advantage is that the password manager is not server based. It does not communicate with the network and can therefore only be hacked if someone has direct access to the device, but this is much more difficult as many devices do not allow this as they do not provide anything for other devices. In addition, you can store such password managers in a VM that has no Internet connection and enter the data into the programs using clipboard sharing. Just like QubesOS does.

The disadvantage is of course that it only exists on one device and you have to copy the file to each device so that changes take effect on the other devices.

Which ones should you use?
#

This is a difficult question as there are countless and the best ones sometimes require technical knowledge but i recommend 3 all of them are Open-Source:

Local Password Manager: https://keepassxc.org

Self Hostet Password Manager: https://github.com/dani-garcia/vaultwarden

Online Hostet: https://bitwarden.com/

KeepassXC
#

KeepassXC is a local password manager that works on all desktop operating systems but unfortunately does not work on smartphones. It does not require any real knowledge of networks or anything else as it is simply a program on the PC.

Vaultwarden
#

Vaultwarden is a password manager that you host yourself it is a fork of Bitwarden. This requires a lot of knowledge about networks if you want to use it everywhere in the World.

I recommend using Docker with Portainer, I even have an article about it. https://xenoelectronics.com/posts/2025/the-ultimate-portainer-starter-guide/

https://github.com/dani-garcia/vaultwarden

To use the password manager you have to install the Bitwarden app.

https://bitwarden.com/download/

This must be installed in the browser.

However, the connection must be secured with a reverse proxy with HTTPS. Otherwise Vaultwarden will refuse the connection. I recommend Nginx-Proxy-Manager.

https://nginxproxymanager.com/

If you want to use it outside your home, I recommend using Netbird or Wireguard.

https://netbird.io/

https://www.wireguard.com/

You can already tell it’s not easy. That’s why I only recommend Vaultwarden to people who know what they are doing.

We are also happy to help you install Vaultwarden.

Bitwarden
#

Bitwarden is the only password manager that is hosted online, I would always host everything myself if it is realistic. But not everyone can do that. Therefore Bitwarden is my only recommendation as it is open source and the price is ok.

Like Vaultwarden, you need the browser app.

https://bitwarden.com/download/

Since you have Bitwarden Online and they set everything up, you just have to connect the app to your account and that’s it.

But always keep in mind that you need great trust in the company. Even if you want to use a different password manager. My favorite example is Lastpass.

https://duckduckgo.com/?q=lastpass+hacked+2024&t=ffab&ia=web

They were hacked in 2024 and lost millions of users’ data with their passwords. Just be smart about what you use before you create an account and entrust your data to them.

How to make good passwords?
#

Last but not least, I would like to explain how to create a good password. I have two pages here where you can read about it.

How do Passwords work: https://www.kicksecure.com/wiki/Passwords

Passphrase generator: https://diceware.rempe.us/

In short, you should have all passwords created with your password generator. The master password should be a passphrase, as people are not good at remembering passwords that have no logic. Passphrases are word chains where you can make up a sentence yourself to memorize it.

Examples:

Password: QGg5j3Ur9EdqXSn9Jbyd7SsV4KJOSxfEdhS9ImDcpyNgLsz2OX72Ki

Passphrase: reach stubble ladle amusement bottle squeegee pebbly

It is important that the passwords have a high entropy. This is a measured value for the password strength, but password managers usually write the entropy value.

Services from XenoElectronics
#

If you need help with your projects or with open source software. Take a look at our contact page and let us know what you need. We will help you to realize your projects.

https://xenoelectronics.com/contact/

Open source support & coffee fund
#

Thank you for reading and for your time!

Become a Patreon supporter

Support via PayPal

Support via Stripe

If you like to share this artikel click the icons below.

How to Secure Your Wordpress Website

Thu, 06 Feb 2025 10:10:36 +0100

What is Wordpress?
#

As always, I like to start with what the product is.

Wordpress is the most popular website builder on the market, easily half of all websites are made with Wordpress. It is comparable to Wix or Squarespace, which are also very popular but proprietary, Wordpress on the other hand is an open source solution.

This makes Wordpress very modular and therefore has many plugins to extend its functionality. So all in all not a bad product.

The only problem is that some people don’t know how to secure a website. Most set it up and forget absolutely basic security measures.

Security measures
#

Updates
#

This is really very basic but update your Wordpress instance and also your plugins. Updates are not always just changes to a program but also security patches. Especially these are important to fix vulnerabilities on the website.

However, you should create a backup before every update. It is always possible that there is a faulty update or that a plugin no longer works after an update.

Secure admin panel credentials
#

Name
#

When you create a Wordpress User. Please dont name your Admin user Admin, Administrator, root or something like that, it doesn’t matter how you call it. As long as it’s nothing obvious.

Hackers know that the default administrator is often called admin and then try to bruteforce it with bots. This way you can bypass bots but you are still not safe from targeted attacks.

My recommendation would be to make the administrator names cryptic. So don’t even use the names of the admins in the company as this can be found out via the website if you make the names and positions public.

After you have created your user. You should remove the default admin user from Wordpress.

Password
#

The password should be as secure as possible. However, this should not be evaluated by a human but by a computer.

Password security is measured in entropy. This should ideally be as high as possible.

If you want to learn something about passwords, here is an article from Kicksecure.

https://www.kicksecure.com/wiki/Passwords

A secure password should have an entropy value of at least 250 bits to ensure that it has post-quantum resistance. For the creation of a password here is also an article from CISA.

https://www.cisa.gov/secure-our-world/use-strong-passwords

In short, your password should be as random as possible. This can be achieved with passwords or passphrases. Which are created via a password manager.

I recommend KeepassXC or Bitwarden. Bitwarden should be self-hosted for security reasons. Never use a Cloud based Password manager. Lastpass is the best Example why.

https://duckduckgo.com/?t=ffab&q=Lastpass+scandal&ia=web

Wordpress themes
#

It should be obvious but themes can contain malware. Since anyone can upload themes, take a close look at whether the uploader is reputable or not.

WAF (Web Application Firewall)
#

Use a WAF (Web Application Firewall) this ensures that the data traffic is checked and filtered from layer 1 to 7 and not just up to layer 3.

If you use a hosting provider such as Hostinger, it already has one installed. Alternatively, you can also use Cloudflare if you have the web server set up locally.

Or use ZenArmor in combination with OpenSence. If you prefer a local WAF. However, this will not protect you from DDOS attacks.

In the end you decide what you use.

Use an SSL or TLS certificate
#

HTTPS is not encrypted just like that. It requires an SSL or TLS certificate for the encryption to work. This can be issued with LetsEncrypt or purchased from your domain provider.

Further protective measures
#

We now have basic security but I still have tips so that a hacker has almost no chance of gaining access.

2FA MFA (Multi Factor Authentifikation)
#

Nowadays it is normal to use multifactor authentication. Even if many people still don’t use it.

The simplest form is the so-called TOTP (Time-based one-time password)

This is used by Mobile authenticator software. Popular solutions are Google Authenticator or Microsoft Authenticator. I don’t think much of either of them because such software does nothing special. I recommend Aegis Authenticator as it is an open source solution and is not linked to an account.

https://getaegis.app/

An MFA plugin i recommend for Wordpress is Wordfence.

https://wordpress.org/plugins/wordfence-login-security/

Limit Login Attempts
#

You should set up that people are automatically banned after multiple authentication failures. A good plugin is this one.

https://wordpress.org/plugins/limit-login-attempts-reloaded/

Change the WordPress Login Page URL
#

The default login page for the admin panel is /wp-admin. This is known to hackers and bots automatically try to hack these pages. If this is changed, bots can no longer find it and bruteforce it. The login page can of course still be found by scanning for the admin page. But very few people do this and it keeps script kids away who don’t know how to do it.

This is a good plugin to quickly change the admin panel page.

https://wordpress.org/plugins/wps-hide-login/

Log Idle Users Out Automatically
#

Users who are inactive should be logged out automatically. They are currently not on the PC and therefore pose a security problem. Here is another plugin to manage this.

https://wordpress.org/plugins/inactive-logout/

Summary
#

I could go on like this forever. But these are the basic things I would do to protect my site. Security is not a product but an endless battle where you have to protect yourself from new things again and again.

So you have to keep learning how to protect your IT infrastructure.

Services from XenoElectronics
#

If you need help with your projects or with open source software. Take a look at our contact page and let us know what you need. We will help you to realize your projects.

https://xenoelectronics.com/contact/

Open source support & coffee fund
#

Thank you for reading and for your time!

Become a Patreon supporter

Support via PayPal

Support via Stripe

If you like to share this artikel click the icons below.

Security on

The Best Starter Guide for Browser Security

Useful Links #

What is a Browser #

Which browser should you use? #

Browser Recommendations #

Librewolf Browser #

Tor Browser #

Brave Browser #

General setting recommendations #

Disable automatic downloading #

Set permisions to Blockt. #

Recommendations for browser analysis and security #

How Secure is a Browser? #

Virus scanner #

Browser Sandbox #

Scam Site Database #

Browser Fingerprinting #

Is your Account Login Information Puplic #

The most secure OS for browsers ever #

Services from XenoElectronics #

Open source support & coffee fund #

Password Managers Which Should Be Used?

Useful links #

What are Password Managers? #

How do they work? #

Types of Password Managers #

Server Solution #

Local Solution #

Which ones should you use? #

KeepassXC #

Vaultwarden #

Bitwarden #

How to make good passwords? #

Services from XenoElectronics #

Open source support & coffee fund #

How to Secure Your Wordpress Website

What is Wordpress? #

Security measures #

Updates #

Secure admin panel credentials #

Name #

Password #

Wordpress themes #

WAF (Web Application Firewall) #

Use an SSL or TLS certificate #

Further protective measures #

2FA MFA (Multi Factor Authentifikation) #

Limit Login Attempts #

Change the WordPress Login Page URL #

Log Idle Users Out Automatically #

Summary #

Services from XenoElectronics #

Open source support & coffee fund #

Useful Links
#

What is a Browser
#

Which browser should you use?
#

Browser Recommendations
#

Librewolf Browser
#

Tor Browser
#

Brave Browser
#

General setting recommendations
#

Disable automatic downloading
#

Set permisions to Blockt.
#

Recommendations for browser analysis and security
#

How Secure is a Browser?
#

Virus scanner
#

Browser Sandbox
#

Scam Site Database
#

Browser Fingerprinting
#

Is your Account Login Information Puplic
#

The most secure OS for browsers ever
#

Services from XenoElectronics
#

Open source support & coffee fund
#

Useful links
#

What are Password Managers?
#

How do they work?
#

Types of Password Managers
#

Server Solution
#

Local Solution
#

Which ones should you use?
#

KeepassXC
#

Vaultwarden
#

Bitwarden
#

How to make good passwords?
#

Services from XenoElectronics
#

Open source support & coffee fund
#

What is Wordpress?
#

Security measures
#

Updates
#

Secure admin panel credentials
#

Name
#

Password
#

Wordpress themes
#

WAF (Web Application Firewall)
#

Use an SSL or TLS certificate
#

Further protective measures
#

2FA MFA (Multi Factor Authentifikation)
#

Limit Login Attempts
#

Change the WordPress Login Page URL
#

Log Idle Users Out Automatically
#

Summary
#

Services from XenoElectronics
#

Open source support & coffee fund
#