The myth of attackers breaking through layers of firewalls or decoding encryption with their smartphones makes for great movies, but poor real world examples. In the majority of cases, attackers go for easy targets: web frameworks with security vulnerabilities, out of date systems, administration pages open to the Internet with guessable passwords or security credentials mistakenly leaked in open source code are all popular candidates. These issues can be easily avoided by adopting a set of elementary security practices, a baseline for security, and making sure everything complies with it. In this talk, we will share with the audience the tools and best practices developed at Mozilla to safely run websites and services online. We will cover infrastructure and application security, tightly integrated with DevOps practices, and discuss ways to improve engineering standards with very minimal overhead. During the talk, we will cover common attacks against web applications, how to protect against them, and tests your controls with the Mozilla Observatory. We will discuss elementary rules to grant access to your infrastructure and your development environments. We will also touch on advanced topics, such as log analysis and fraud detection. This is a beginner talk, for developers and operators with an interest in web security. We will explain core concepts and share pointers for the audience to get started and continue their research long after the talk.