Editorial illustration.
Originally published 20 June 2023; rewritten and reviewed on 15 October 2026.
A site can look unchanged while its plugins, credentials and dependencies become harder to trust. I would treat website security as recurring maintenance with named owners, rather than a certificate installed once at launch.
Check the application and its access
- Inventory the stack. Record the CMS, runtime, dependencies and owners so updates have a clear destination.
- Maintain supported versions. Test and apply relevant fixes, including the components outside the visible website.
- Protect administration. Use appropriate authentication and additional verification for privileged access.
- Separate accounts and roles. Remove unused access and avoid shared administrator credentials.
- Enforce authorisation per operation. A hidden button does not prevent a direct request to its endpoint.
- Validate input at the boundary. Check type, size and allowed values according to the operation.
- Use parameterised database access. Do not create executable queries by concatenating untrusted values.
- Encode output for its context. HTML text, attributes and JavaScript are different contexts.
Check delivery and operations
- Serve the intended routes over HTTPS. Include redirects, subdomains and externally loaded resources.
- Constrain uploads. Enforce format, size, storage and download permissions on the server.
- Protect secrets. Keep them out of source, browser bundles and routine logs; define rotation and ownership.
- Observe important failures. Collect useful security and application events with a response owner.
- Test recovery. Verify that backups and deployment records can actually restore the service.
Turn the checklist into evidence
For each item, record the relevant system, current result, outstanding work and responsible person. Test changes in an environment suitable for the task and preserve a recovery route before restricting access.
A scan result can help locate issues, but it does not replace understanding the application. The review becomes valuable when the team can demonstrate that controls work and knows what to do when one of them fails.