Understanding and Improving Web Security Performance