Website Security Tips
The internet is full of 100-item security checklists. Here are the twenty items that, if all shipped, cover roughly 90% of real-world risk for a typical business site.
The list
HTTPS everywhere; HSTS with preload; strict CSP; secure cookies; MFA on every admin account; least-privilege service accounts; automated dependency scanning; automated certificate renewal; DMARC on reject; CAA records; regular backups tested by restore; WAF on the edge; rate limiting on auth endpoints; secrets in a vault, never in code; logging that survives compromise; incident response runbook; principle of least privilege in the app; input validation server-side; output encoding; and a security.txt file so researchers can reach you.
Frequently asked questions
Try it on your site
Run a free Website Auditor scan and see which of these controls you're missing.
Run a scan