The quantum key distribution (QKD), guaranteed by the principle of quantum physics, is a promising solution for future secure information and communication technology. However, device imperfections compromise the security of real-life QKD systems, restricting the wide deployment of QKD. This study reports a decoy-state BB84 QKD experiment that considers both source and detection imperfections. In particular, we achieved a rigorous finite-key security bound over fiber links of up to 75 km by applying a systematic performance analysis. Furthermore, our study considers more device imperfections than most previous experiments, and the proposed theory can be extended to other discrete-variable QKD systems. These features constitute a crucial step toward securing QKD with imperfect practical devices.