Quantum key distribution (QKD), guaranteed by the principle of quantum physics, is a promising solution for future secure information and communication technology. However, device imperfections compromise the security of real-life QKD systems, restricting the wide deployment of QKD. This study reports a decoy-state Bennett-Brassard 1984 (BB84) QKD experiment that considers both source and detection imperfections. In particular, we achieve a rigorous finite-key security bound over fiber links of up to 75 km by applying a systematic performance analysis. Furthermore, our study considers more device imperfections than most previous experiments, and the proposed theory can be extended to other discrete-variable QKD systems. These features constitute a crucial step toward securing QKD with imperfect practical devices.