Security
A practical website security checklist
Most breaches come from basic gaps. Cover these and you remove the easy targets.
Mohd Aibad · · 5 min read
Attackers mostly look for easy wins: outdated software, weak passwords and exposed secrets. Closing those gaps removes most of the risk.
- HTTPS everywhere, with redirects from HTTP.
- Keep the framework, plugins and dependencies up to date.
- Strong, unique passwords and two-factor sign-in for every admin.
- Secrets live in environment variables, never in the code repository.
- Validate and sanitise all user input to prevent injection and XSS.
- Limit what each account and API key is allowed to do.
- Back up regularly, and test that you can restore.
- Add security headers such as a content security policy.
Security is a habit, not a launch task. Schedule regular updates and reviews.