Member Avatar for jimdj

Where do you secure a website? Is it done one the host or is it done at design time, or both. And how do you do it. Thnx

  • 4 Contributors
  • 3 Replies
  • 100 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by Lusiphur

Dani AI

Generated

Short answer for : secure a website at all stages — design, deployment (host), and operation. Treat security as layered defenses: build safe code, harden the server, and run monitoring/updates. Use a known baseline such as the OWASP Top Ten when you start threat modeling.

Design-time essentials developers should apply

  • Never rely on client-side checks alone; enforce validation and output encoding on the server (as hinted).
  • Use parameterized queries / prepared statements to stop injection attacks.
  • Store passwords with a modern KDF (bcrypt/argon2), not plain hashing.
  • Implement proper authorization checks on every endpoint and validate uploaded files (type, size, storage outside the web root).
  • Keep secrets out of source control; use environment variables or a secrets manager.
  • Automate dependency scanning and SAST in CI.

Host and deployment hardening

  • Minimize services, apply OS/webserver patches, restrict file permissions, and disable directory listing (building on ’s directory-protection point).
  • Enforce HTTPS with modern TLS configuration and automated certs (use Let’s Encrypt or a managed cert service), and follow recommended cipher/configuration guides.
  • Add secure headers and cookie flags: HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and set Secure, HttpOnly, SameSite on cookies.
  • Run a WAF or IDS, centralize logging, and keep tested backups.

Operational workflow and quick checks

  • Add automated DAST scans, scheduled patching, and an incident plan.
  • For troubleshooting: check browser console for mixed content, inspect response headers and cookies (e.g., curl -I https://example.com), and verify TLS/cipher choices with online scanners.
    Further developer-focused guidance and concrete controls are available in the OWASP Cheat Sheet Series.

Recommended Answers

All 3 Replies

Member Avatar for Barbaradavid

Well I think that there are many ways of website security, Many Web forms include some JavaScript data validation. If this validation includes anything meant to provide improved security, that validation means almost nothing, we can also try to make different session for the security, Without the proper web site security, web site files and data can easily be changed, damaged or stolen, and the integrity of the company compromised.

Member Avatar for Lusiphur

Where do you secure a website?

Are you referring to securing directories/content against outside viewing? Or are you talking about a secure (read: SSL) connection?

If you're talking about content protection there's a number of approaches that can be taken from physically password protecting directories to masking directory locations and setting up password/login pages with indirect links to content and others. Some of this can be set up on the provider end, many times these will be 'adjustable' through the user control panel they provide you.

If you're talking about setting up secure connection (SSL) then you need to purchase an SSL Certificate (usually via your provider since it is server specific).

Without knowing specifically what you are looking for, unfortunately, can't be more specific in the help provided.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.