Mozilla has an easy-to-read guide for this stuff as well: https://infosec.mozilla.org/guidelines/web_security

As well as a system you can use to evaluate your site: https://observatory.mozilla.org/