A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
A useful way to learn this is to start with the browser's observable behavior, not the tag list. In this lesson, the focus is unsafe target links, permissive embeds, mixed resources, and metadata leaks. That matters because HTML is interpreted by a parser and then exposed to browser features such as navigation, accessibility tooling, form controls, media handling, and script APIs. A correct-looking screenshot can still hide a poor document model.
<iframe src="https://vendor.example" allow="*"></iframe>
Start with the smallest meaningful example. The working snippet demonstrates the core syntax, but the important part is what each piece contributes: the element supplies semantics or behavior, attributes refine that meaning, and surrounding structure gives the browser context. Don't add markup just because a framework or copied example happens to include it.
Implementation note: Audit markup for privileges and dependencies that were added casually during integration. Keep the browser behavior observable while you work.
<p id="name"></p><script>document.querySelector("#name").textContent = userName;</script>
The browser's defaults are part of the behavior you are learning. Prefer native semantics first, then test the exact combination of attributes and content you plan to ship.
<a href="https://vendor.example"target="_blank"rel="noopener noreferrer">Vendor</a>
In a team codebase, the expensive bugs usually come from assumptions. Someone assumes an anchor is just a button with a different visual style, that a placeholder is a label, that an iframe is only a rectangle, or that a client-side constraint is security. The safe engineering move is to name the browser behavior you actually depend on and encode it directly in HTML.
Checkpoint: you can now connect the markup for common html security misconfigurations to a browser behavior and a concrete debugging step.
Field tip: for common html security misconfigurations, test both the ordinary path and the first case that makes your assumptions false.
Finish the lesson once you have worked through the material. This awards ★ 20 XP.