A practical security checklist for launching a web application

Security reviews often arrive too late and produce long reports full of low-priority findings. This checklist focuses on the controls that prevent the most common, most damaging problems. It is not a substitute for a formal assessment of high-risk systems, but it catches a great deal.

Authentication

• Passwords hashed with a modern algorithm (Argon2id or bcrypt) — never stored or logged in plain text.
• Rate limiting and lockout on login, with generic error messages that do not reveal whether an account exists.
• Multi-factor authentication required for administrators.
• Session cookies set HttpOnly, Secure and SameSite; sessions expire after inactivity and can be revoked.

Authorisation

Most serious application vulnerabilities are authorisation failures: a user changes an ID in a URL and sees someone else's record. Every endpoint must check not only "is this user logged in" but "may this user act on this specific object".

Input and output

• Validate every input on the server against a schema: types, lengths, formats and allowed values.
• Use parameterised queries or an ORM — no string-built SQL.
• Escape output by default; never render user-supplied HTML without strict sanitisation.
• Validate uploads by content, not file extension, and serve them with safe headers.

Secrets

• No credentials in source code, images or client bundles.
• Separate secrets for each environment; production secrets accessible to as few people as possible.
• Rotate any secret that was ever committed to a repository.

Headers and transport

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'; frame-ancestors 'none'; ...
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

Dependencies

Run a dependency audit and fix high and critical findings before launch. Pin versions with a lockfile and enable automated update pull requests so fixes arrive continuously.

Infrastructure

• Databases and caches reachable only from private networks.
• Firewall allows only the ports you need.
• Administrative access with individual keys, not shared passwords.
• Errors in production return generic messages; details go to logs.

Backups and logging

Restore a backup into a scratch environment before launch and time it. Log authentication events, permission failures and administrative actions with enough detail to investigate, without logging passwords, tokens or unnecessary personal data.

Write it down

Finally, document who to call and what to do if something goes wrong. A one-page incident plan written calmly before launch is worth more than a perfect one written during an incident. For a structured review, see our cybersecurity service.