Use SSL sitewide. Enable SSL (https). Make sure that any attempt to connect via http immediately redirects to the SSL site.

Follow accepted best practices. Refer to SSL/TLS Deployment Best Practices from SSL Labs. Follow all of the advice there, including use of using SSL for all site traffic, marking all cookies as secure, avoiding mixed content, enabling HSTS, and other recommendations.

Avoid third-party scripts. Avoid third-party script (i.e., any Javascript downloaded from any other domain). Avoid trusting any other sites or domains. For instance, don't use third-party widgets or analytics; don't use ads; host all Javascript locally, on your own server. They present an element of risk, and an elections context that sort of risk is probably unnecessary and undesirable.

Buy an EV cert. Spend the extra amount to get an extended validation (EV) certificate. This will provide users with an extra level of assurance.

Use pre-loaded HSTS and public key pinning. Register your domain with Google Chrome and Firefox, to request to add your domain to Google's and Mozilla's pre-loaded HSTS list. This helps defend against SSL stripping and man-in-the-middle attacks, even for users who have never visited your domain before (and thus haven't had a chance to receive the initial HSTS information from your domain). Enable pre-loaded public key pinning with them, as well, if you can.

Use forward-secure ciphersuites. Configure SSL on your web server to enable forward secrecy for all clients that support the corresponding ciphersuites. See Deploying forward secrecy from SSL Labs for details on how to do this. Generally speaking, you'll set the order of preferred ciphersuites on the server so that ECDHE is your first choice of ciphersuite; DHE is your second choice; and standard (non-forward-secure) ciphersuites are lower priorities.

Support TLS 1.2. Make sure you support the latest versions of TLS, for voters with browsers that support those versions. The latest versions of TLS are not yet supported by all browsers, but they add defenses against some recent attacks on SSL.

Check your site. After deployment, check your SSL configuration using the SSL checker at SSL Pulse (provided by SSL Labs). Make sure you have a grade of A. Fix any issues that the SSL checker spots.

Use SSL sitewide. Enable SSL (https). Make sure that any attempt to connect via http immediately redirects to the SSL site.

Follow accepted best practices. Refer to SSL/TLS Deployment Best Practices from SSL Labs. Follow all of the advice there, including use of using SSL for all site traffic, marking all cookies as secure, avoiding mixed content, enabling HSTS, and other recommendations.

Avoid third-party scripts. Avoid third-party script (i.e., any Javascript downloaded from any other domain). Avoid trusting any other sites or domains. For instance, don't use third-party widgets or analytics; don't use ads; host all Javascript locally, on your own server. They present an element of risk, and an elections context that sort of risk is probably unnecessary and undesirable.

Buy an EV cert. Spend the extra amount to get an extended validation (EV) certificate. This will provide users with an extra level of assurance.

Use pre-loaded HSTS and public key pinning. Register your domain with Google Chrome and Firefox, to request to add your domain to Google's and Mozilla's pre-loaded HSTS list. This helps defend against SSL stripping and man-in-the-middle attacks, even for users who have never visited your domain before (and thus haven't had a chance to receive the initial HSTS information from your domain). Enable pre-loaded public key pinning with them, as well, if you can.

Use forward-secure ciphersuites. Configure SSL on your web server to enable forward secrecy for all clients that support the corresponding ciphersuites. See Deploying forward secrecy from SSL Labs for details on how to do this. Generally speaking, you'll set the order of preferred ciphersuites on the server so that ECDHE is your first choice of ciphersuite; DHE is your second choice; and standard (non-forward-secure) ciphersuites are lower priorities. Forward secrecy helps protect the confidentiality of all earlier communications (including voters' votes) if the server's private key is compromised after the election, which seems helpful in an elections context.

Support TLS 1.2. Make sure you support the latest versions of TLS, for voters with browsers that support those versions. The latest versions of TLS are not yet supported by all browsers, but they add defenses against some recent attacks on SSL.

Check your site. After deployment, check your SSL configuration using the SSL checker at SSL Pulse (provided by SSL Labs). Make sure you have a grade of A. Fix any issues that the SSL checker spots.

Advertise the https URL. When you communicate with voters to tell them what web page to visit to vote, list the full https: URL. For instance, tell voters to enter https://www.elections.us into their browser, not http://www.elections.us or www.elections.us (the last two are treated identically by browsers, and may be vulnerable to MITM attacks).

Use SSL sitewide. Enable SSL (https). Make sure that any attempt to connect via http immediately redirects to the SSL site.

Follow accepted best practices. Refer to SSL/TLS Deployment Best Practices from SSL Labs. Follow all of the advice there, including use of using SSL for all site traffic, marking all cookies as secure, avoiding mixed content, enabling HSTS, and other recommendations.

Avoid third-party scripts. Avoid third-party script (i.e., any Javascript downloaded from any other domain). Avoid trusting any other sites or domains. For instance, don't use third-party widgets or analytics; don't use ads; host all Javascript locally, on your own server. They present an element of risk, and an elections context that sort of risk is probably unnecessary and undesirable.

Buy an EV cert. Spend the extra amount to get an extended validation (EV) certificate. This will provide users with an extra level of assurance.

Use pre-loaded HSTS and public key pinning. Register your domain with Google Chrome and Firefox, to request to add your domain to Google's and Mozilla's pre-loaded HSTS list. This helps defend against SSL stripping and man-in-the-middle attacks, even for users who have never visited your domain before (and thus haven't had a chance to receive the initial HSTS information from your domain).

Use SSL sitewide. Enable SSL (https). Make sure that any attempt to connect via http immediately redirects to the SSL site.

Follow accepted best practices. Refer to SSL/TLS Deployment Best Practices from SSL Labs. Follow all of the advice there, including use of using SSL for all site traffic, marking all cookies as secure, avoiding mixed content, enabling HSTS, and other recommendations.

Avoid third-party scripts. Avoid third-party script (i.e., any Javascript downloaded from any other domain). Avoid trusting any other sites or domains. For instance, don't use third-party widgets or analytics; don't use ads; host all Javascript locally, on your own server. They present an element of risk, and an elections context that sort of risk is probably unnecessary and undesirable.

Buy an EV cert. Spend the extra amount to get an extended validation (EV) certificate. This will provide users with an extra level of assurance.

Use pre-loaded HSTS and public key pinning. Register your domain with Google Chrome and Firefox, to request to add your domain to Google's and Mozilla's pre-loaded HSTS list. This helps defend against SSL stripping and man-in-the-middle attacks, even for users who have never visited your domain before (and thus haven't had a chance to receive the initial HSTS information from your domain). Enable pre-loaded public key pinning with them, as well, if you can.

Use forward-secure ciphersuites. Configure SSL on your web server to enable forward secrecy for all clients that support the corresponding ciphersuites. See Deploying forward secrecy from SSL Labs for details on how to do this. Generally speaking, you'll set the order of preferred ciphersuites on the server so that ECDHE is your first choice of ciphersuite; DHE is your second choice; and standard (non-forward-secure) ciphersuites are lower priorities.

Support TLS 1.2. Make sure you support the latest versions of TLS, for voters with browsers that support those versions. The latest versions of TLS are not yet supported by all browsers, but they add defenses against some recent attacks on SSL.

Check your site. After deployment, check your SSL configuration using the SSL checker at SSL Pulse (provided by SSL Labs). Make sure you have a grade of A. Fix any issues that the SSL checker spots.