Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking for a complete security checklist that will allow me to secure my websites. After some research here is what I got:

-use SSL to protect authenticated content
-tighten the server TCP/IP stack (e.g. enabling syn cookies, limiting the number of connections by ips.., allowing only public access to port 80...)
-prevent illegitimate bots from crawling your website to save bandwidth for legitimate users (e.g. using mod_rewrite and blocking based on HTTP user agent)
-review your code for common security mistakes (e.g. with OWASP top 10)
-use an application firewall for additional security (e.g. mod_security)
-test your application security with assessment tools (e.g. these questions on "webmasters" or "serverfault")

Any input to complete this list would be appreciated. Also information as to how much money/time is usually required to carry out these steps would allow a cost-effective approach to security.

share|improve this question
Made community wiki as per the faq – John Conde Jun 14 '11 at 14:56
up vote 0 down vote accepted

Already answered at: what should a developer know about websites? Which covers security, and everything else, performance, SEO, etc...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.