Why Many Websites are still Insecure (and How to Fix Them)