Publishing your SecureDrop#
This sections covers how to publicize your SecureDrop, and in particular our recommendations for guiding potential Sources to your SecureDrop from your organization’s website.
SecureDrop is only as secure as the environment that surrounds it. To keep Sources safe, the news organization’s website, physical space, and dedicated SecureDrop hardware must employ a set of basic security best practices or risk losing any source protection provided by SecureDrop.
Freedom of the Press Foundation maintains a directory of SecureDrops that meet the minimum requirements for deployment best practices outline in this section. If your organization cannot follow the minimum guidelines, we cannot recommend your SecureDrop instance as safe to use.
In addition to implementing the following best practices, we strongly recommend that you have a reputable security firm perform a review of your organization’s public website prior to launching an instance of SecureDrop. Upon request, we can help put you in touch with a few security firms if you need more assistance.