Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I'm looking for a complete security checklist that will allow me to secure my websites. After some research here is what I got:

-use SSL to protect authenticated content
-tighten the server TCP/IP stack (e.g. enabling syn cookies, limiting the number of connections by ips.., allowing only public access to port 80...)
-prevent illegitimate bots from crawling your website to save bandwidth for legitimate users (e.g. using mod_rewrite and blocking based on HTTP user agent)
-review your code for common security mistakes (e.g. with OWASP top 10)
-use an application firewall for additional security (e.g. mod_security)
-test your application security with assessment tools (e.g. these questions on "webmasters" or "serverfault")

Any input to complete this list would be appreciated. Also information as to how much money/time is usually required to carry out these steps would allow a cost-effective approach to security.

share|improve this question
    
Made community wiki as per the faq –  John Conde Jun 14 '11 at 14:56
add comment

1 Answer

up vote 0 down vote accepted

Already answered at: what should a developer know about websites? Which covers security, and everything else, performance, SEO, etc...

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.