[jrpt]

It's not magic security dust. I don't claim all you have to do is use it to have a secure website, but to address a few prominent classes of attacks you can use it.

And security is hard, so defense in depth makes sense.