Securebydefault

Secure by default, also referred to as secure-by-default, is a design principle in computer security and software engineering. It holds that systems should be configured to enforce robust security measures and minimize exposure out of the box. Only when explicitly changed by an informed administrator or user should less secure options be enabled. This approach reduces reliance on user action to achieve security and lowers the risk of misconfiguration.

Key ideas include fail-safe defaults, least privilege, and default-deny policies. Implementations typically emphasize encryption by default for data at rest and in transit, strong authentication, and privacy protections enabled by default. Network settings and access controls are commonly configured to block unauthorized access unless explicitly allowed. In web services, security headers and strict transport security are often enabled by default, and applications may disable insecure features unless a user opts in.

Benefits include reduced risk from user error, improved resilience to common misconfigurations, and a smoother path toward compliance and secure operation. Challenges involve balancing compatibility and functionality, potential performance costs, and the need for clear opt-out mechanisms and thorough documentation. Security by default does not replace ongoing risk assessment, defense in depth, or user education.

Origins trace to general security principles such as fail-safe defaults and secure design, and it has become a common goal in operating systems, web platforms, and software packages. See also secure by design, privacy by default.