Website Security Basics Every Developer Should Know

Every website is a target, whether it's a small business landing page or a large e-commerce platform. Attackers rarely care how big your site is — automated bots scan the entire internet looking for known vulnerabilities, and an unpatched or misconfigured site gets flagged just as easily as a high-profile one. The good news is that a small set of well-understood practices closes off the vast majority of real-world attacks.

Always Use HTTPS

HTTPS encrypts data between the browser and your server, preventing attackers on the same network from reading or tampering with traffic. It's also a baseline requirement now — browsers actively flag HTTP sites as "Not Secure," and Google has confirmed HTTPS as a ranking signal.

• Get a free certificate through Let's Encrypt or your hosting provider
• Redirect all HTTP traffic to HTTPS at the server level
• Enable HSTS (HTTP Strict Transport Security) so browsers refuse to connect over plain HTTP even if a link points there

Never Trust User Input

This is the single most important principle in web security. Every form field, URL parameter, and uploaded file is a potential attack vector, and it should be validated and sanitized on the server — not just in client-side JavaScript, which any attacker can simply bypass.

• SQL Injection: use parameterized queries or an ORM — never concatenate raw user input directly into a SQL string
• Cross-Site Scripting (XSS): escape user-generated content before rendering it in HTML, and use a Content Security Policy as a second layer of defense
• File uploads: validate file type and size server-side, store uploads outside the web root, and never trust the client-reported MIME type

Hash Passwords Properly

Never store passwords in plain text, and never use fast general-purpose hashes like MD5 or SHA-1 for passwords — they're designed to be fast, which is exactly the wrong property for password storage, since it makes brute-forcing dramatically easier.

• Use a purpose-built, slow hashing algorithm: bcrypt, Argon2, or scrypt
• Let the hashing library handle salting automatically — modern libraries like bcrypt do this by default
• Never log or transmit plaintext passwords anywhere, including in error messages

Set Security Headers

A handful of HTTP response headers meaningfully reduce your attack surface, and they cost nothing to add:

• Content-Security-Policy — restricts which sources scripts, styles, and other resources can load from, making XSS attacks much harder to execute even if an injection point exists
• X-Content-Type-Options: nosniff — stops browsers from guessing content types in a way that can be exploited
• X-Frame-Options: SAMEORIGIN — prevents your site from being embedded in an iframe on another domain, blocking clickjacking attacks
• Referrer-Policy — controls how much URL information is leaked to other sites when users click outbound links

Protect Against CSRF

Cross-Site Request Forgery tricks a logged-in user's browser into submitting a request they didn't intend to make — for example, a hidden form on a malicious site that submits to your "change password" endpoint using the victim's existing session.

• Use CSRF tokens on every state-changing form (most frameworks generate these automatically)
• Set cookies with SameSite=Strict or SameSite=Lax to prevent them from being sent on cross-site requests

Keep Dependencies Updated

A huge share of real-world breaches don't come from novel attacks — they come from known, already-patched vulnerabilities in outdated libraries and frameworks that nobody got around to updating.

• Run npm audit (or your ecosystem's equivalent) regularly, and actually act on the results
• Enable automated dependency update tools like Dependabot to catch vulnerabilities as they're disclosed
• Remove unused dependencies entirely — code you don't run can't be exploited

Rate Limit and Monitor

• Rate-limit login endpoints and APIs to slow down brute-force and scraping attempts
• Use a Web Application Firewall (WAF) like Cloudflare to filter obviously malicious traffic before it reaches your server
• Log authentication attempts and monitor for unusual patterns, like a single IP hitting your login endpoint hundreds of times

A Baseline Security Checklist

• HTTPS enforced everywhere, with HSTS enabled
• All user input validated and sanitized server-side
• Passwords hashed with bcrypt or Argon2, never stored in plain text
• Security headers configured (CSP, X-Frame-Options, X-Content-Type-Options)
• CSRF protection on all state-changing forms
• Dependencies audited and kept up to date
• Rate limiting on sensitive endpoints

Conclusion

Website security isn't about achieving some perfect, unbreakable state — it's about consistently closing the common, well-known holes that automated attacks rely on. Most successful attacks exploit basic oversights, not sophisticated zero-days. Get these fundamentals right, keep them maintained, and you'll be meaningfully more secure than the majority of sites on the web.