HTTPS and SSL
HTTPS encrypts information exchanged between the visitor and the website. A valid certificate is an essential part of a modern public website.
Strong authentication
Admin and member accounts should use appropriate password handling, access controls and sensible session management.
Validate form input
Anything submitted by a visitor should be treated as untrusted input. Validation and safe processing help prevent unexpected data from reaching application logic.
Use safe database queries
Database queries should be constructed using appropriate safe techniques rather than directly inserting untrusted visitor input.
Limit access
Users should only have the permissions required for their role. Administrative functions should not be exposed unnecessarily.
Updates and backups
Keep supported software and server components maintained, and keep backups that can actually be restored.
Security is ongoing
Websites change. New forms, accounts, integrations and scripts can introduce new requirements, so security should be reviewed as the site evolves.