Security guides

How do I protect my website?

Fix the code first. Most break-ins use a missing access check, an unsafe query, a leaked key or an outdated package, not a clever attack. Work through those in order, then add the outer layers.

Do these in order

1. Check access on the server. Every page and API that returns private data must confirm who is asking and that they may see that record. Hiding a button protects nothing.
2. Stop unsafe input. Use parameterized queries to prevent SQL injection, and escape output to prevent cross-site scripting.
3. Remove secrets from code. If a key was ever committed, replace it.
4. Update dependencies. Run npm audit, pip-audit or your language's equivalent, and fix what your code actually uses.
5. Limit login attempts. Add rate limits and strong password storage such as bcrypt or Argon2.
6. Turn on HTTPS and security headers. Add HSTS, a Content Security Policy and X-Content-Type-Options: nosniff.
7. Keep tested backups. A backup you have never restored isn't a plan.

What about a firewall?

A web application firewall can block common attacks, but it can't see that one customer can read another's data. Use it as well as these fixes, not instead of them.