I'm looking for a complete security checklist that will allow me to secure my websites. After some research here is what I got:
-use SSL to protect authenticated content
-tighten the server TCP/IP stack (e.g. enabling syn cookies, limiting the number of connections by ips.., allowing only public access to port 80...)
-prevent illegitimate bots from crawling your website to save bandwidth for legitimate users (e.g. using mod_rewrite and blocking based on HTTP user agent)
-review your code for common security mistakes (e.g. with OWASP top 10)
-use an application firewall for additional security (e.g. mod_security)
-test your application security with assessment tools (e.g. these questions on "webmasters" or "serverfault")
Any input to complete this list would be appreciated. Also information as to how much money/time is usually required to carry out these steps would allow a cost-effective approach to security.
