Web app security checklist
A practical web application security checklist covering authentication, input handling, transport, dependencies, secrets, and logging.
Last updated
Your ticks are saved on this device only — never uploaded, never synced.
Auth & sessions
0/5Input & output
0/5Transport & headers
0/4Dependencies & secrets
0/5Logging
0/4Questions
What is the highest-value item here?
Server-side authorization on every state-changing endpoint. Hiding a button is not a control, and the endpoint still accepting the request is the most common serious flaw in an otherwise careful application.
Do security headers actually help?
They are defence in depth rather than a fix. A content security policy limits the damage of an injection that already happened; it does not stop the injection, so it complements input handling rather than replacing it.
How do I keep secrets out of the repository?
Environment variables plus a scanner in CI, and treat any secret that ever reached a commit as compromised — history is public even if the file was deleted. Rotate rather than removing the commit.
How often should dependencies be audited?
Automatically on every build, with alerts on new advisories. Manual quarterly reviews miss the window that matters, since disclosure to exploitation is frequently measured in days.
Does passing this checklist mean the app is secure?
No. It covers the common, well-documented classes and cannot address business-logic flaws, misconfigured infrastructure or anything specific to your architecture. It raises the floor rather than certifying anything.