Today, anyone trying to advise a web site owner on security has to balance elements within the site owner's control — fonts, domain names, sources of content, validation of user input, for example — against extrinsic elements the site owner can't touch. The latter include user operating systems and software, the security of remote sites supplying content and homologue internationalised domain names. Plus, there are all those tricky details of interactions between tags, and everywhere — in all software — bugs.