I'm looking for a complete security checklist that will allow me to secure my websites. After some research here is what I got:

-use SSL to protect authenticated content
-tighten the server TCP/IP stack (e.g. enabling syn cookies, limiting the number of connections by ips.., allowing only public access to port 80...)
-prevent illegitimate bots from crawling your website to save bandwidth for legitimate users (e.g. using mod_rewrite and blocking based on HTTP user agent)
-review your code for common security mistakes (e.g. with OWASP top 10)
-use an application firewall for additional security (e.g. mod_security)
-test your application security with assessment tools (e.g. these questions on "webmasters" or "serverfault")

Any input to complete this list would be appreciated. Also information as to how much money/time is usually required to carry out these steps would allow a cost-effective approach to security.

  • Made community wiki as per the faq
    – John Conde
    Jun 14, 2011 at 14:56

1 Answer 1


Already answered at: what should a developer know about websites? Which covers security, and everything else, performance, SEO, etc...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.