Web Application Security Checklist: 4 Areas to Cover

Web application security depends on four practice areas every development team needs to cover: vulnerability testing, authentication controls, database protection, and cloud configuration. Treating these as standard development practice rather than an afterthought is the difference between a secure product and an expensive breach. Use this checklist to audit your web app at any stage of development, whether you are building in-house or managing an outsourced team.

Application Security Testing and Development

Application security testing is the foundation of any secure development practice. According to IBM's 2026 Cost of a Data Breach Report, the global average cost of a data breach reached a record $4.99 million, up 12% on the year before. Unpatched software is now the most common way in: in Verizon's 2026 Data Breach Investigations Report, exploited vulnerabilities were the initial access vector in 31% of breaches, overtaking stolen credentials. The same report found that organizations fully remediated only 26% of the vulnerabilities in CISA's Known Exploited Vulnerabilities catalog in 2025, down from 38% the year before. The OWASP Top 10 remains the most widely referenced guide to the risks most likely to affect web applications in production. Its 2025 edition ranks broken access control, security misconfiguration and software supply chain failures as the top three. Whether you are developing in-house or working with an outsourced QA team, the following practices should be non-negotiable from the first sprint.

1. Scan for web application vulnerabilities regularly: every pushed version through to production should be scanned. Address weak points as soon as they are detected.
2. Validate all input on the server, and encode output for the context it is rendered in (HTML, JavaScript, CSS or URLs). Contextual output encoding is the main defense against cross-site scripting. For SQL, use parameterized queries instead (see Database Security below).
3. Start with secure coding. Develop each piece of software using secured and separate development environments. Apply equal security vigilance to development and production systems.
4. Automate dependency updates so security patches reach production quickly. Vulnerable and outdated components now fall under software supply chain failures, ranked third in the OWASP Top 10:2025.
5. Deploy without downtime, so applying a patch never has to wait for a maintenance window.
6. Use dependency scanning tools such as Snyk or npm audit to continuously identify vulnerable packages across your dependency tree before they reach production.
7. Keep direct SSH access to production services for one-off diagnosis only, and log every session.
8. Decommission any application whose maintenance and support are no longer available, rather than leaving it running unpatched.
9. Use TLS across the whole site, not just on login forms. Enforce HTTPS everywhere.
10. Send the Strict-Transport-Security (HSTS) header so browsers only connect over TLS, and redirect HTTP requests to HTTPS on the server as a backup.
11. Ensure that users accessing your APIs are properly authenticated and authorized at every endpoint, not just at the initial login.
12. Implement Content Security Policy (CSP) headers to reduce the risk of cross-site scripting (XSS) attacks.
13. Monitor your APIs for illegal or abnormal requests, with canary checks, rate limits and anomaly alerts, and block automated attacks before they escalate.
14. Ensure that all random number generation and cryptographic algorithm choices meet current standards. Do not implement your own cryptography.
15. Log security-relevant events, such as logins, failed logins, permission changes and admin actions, and alert on anomalies. Security logging and alerting failures are A09 in the OWASP Top 10:2025.
16. Maintain a documented and practiced security incident response plan so your team knows exactly what to do when something goes wrong.

Authentication

Authentication is the first line of defense for any web application and, historically, one of the most exploited weaknesses. Credential abuse has lost first place to exploited vulnerabilities, but it was still the initial access vector in 13% of the breaches in Verizon's 2026 report, and authentication failures keep their own place in the OWASP Top 10:2025. Weak or improperly implemented authentication creates an entry point that no amount of downstream protection can fully compensate for. The items below cover the core controls every production web app should have in place.

1. Ensure that all passwords are hashed using a strong, current algorithm such as bcrypt, Argon2, or scrypt. Do not implement your own cryptographic hashing.
2. Do not build your own login, password reset, or account recovery flows from scratch. Use industry-standard libraries and proven components that handle edge cases your team may not anticipate.
3. Set clear but practical password rules that encourage long, strong passwords without making them so complex that users resort to unsafe workarounds like reusing credentials across services.
4. Require multi-factor authentication (MFA) for all administrative accounts and offer it as an option for all users. WebAuthn and passkeys are increasingly viable as phishing-resistant alternatives to SMS-based MFA.
5. Add CAPTCHA or equivalent bot protection to front-end APIs that could be abused to overload back-end services in a denial-of-service attack.
6. Set session cookies with the HttpOnly, Secure and SameSite attributes, and invalidate sessions on logout and password reset.
7. Protect every state-changing request against cross-site request forgery (CSRF) with tokens, using SameSite cookies as an added layer. Many frameworks provide token protection by default; check that yours has it switched on.
8. Enforce multi-factor authentication for all logins to third-party service vendors and infrastructure your application depends on.

Database Security

The database is where the most sensitive information in your application lives: user credentials, personal data, billing details, access tokens. A breach at the database layer typically produces the most damaging kind of exposure. Encryption at rest, least-privilege access controls, and protection against SQL injection are baseline requirements for any production web application. Access control deserves as much attention as encryption: broken access control is the number one risk in the OWASP Top 10:2025.

1. Fully encrypt all data at rest, including sensitive user fields such as names, billing details, and access tokens.
2. Store all database backups in an encrypted manner. Verify that backup restoration actually works before you need it in an incident.
3. Ensure that all back-end databases and services run on private VPCs that are not publicly accessible.
4. Apply strong passwords and minimum-privilege access controls to all database user accounts. No application or service should have more database access than it requires to function.
5. Manage secrets and credentials using a dedicated key store or secrets manager such as HashiCorp Vault or AWS Secrets Manager, rather than hardcoding them in source code or storing them in version control.
6. Prevent SQL injection by using parameterized queries or prepared statements throughout your codebase. In Node.js, prefer the mysql2 package, which supports prepared statements, over the older mysql package, and keep it patched.

Cloud Configuration and Network Security

Security misconfiguration is the second-ranked risk in the OWASP Top 10:2025, and cloud environments multiply the number of settings that can be wrong. Getting cloud configuration right requires active management and regular auditing. Our cybersecurity consulting team regularly identifies configuration gaps that development teams did not know existed.

1. Expose the minimum number of open ports necessary for your services to function. Security through obscurity is not a protection, but non-standard ports do increase the effort required by automated scanners.
2. For inter-service communication, divide logical services into separate VPCs and use VPC peering rather than routing traffic across the public internet.
3. Minimize your external IP exposure and restrict internet-facing endpoints. Apply minimum access privilege for your operations and developer team across all cloud environments.
4. Use IAM roles for all service access rather than root credentials or long-lived access keys.
5. Rotate passwords and access keys on a regular schedule. Automate rotation wherever possible rather than relying on manual processes that get missed.
6. Enable cloud security posture management (CSPM) tooling to continuously monitor your cloud environment for misconfiguration and drift from your established security baseline.

Key Takeaways

The four areas in this checklist cover the controls that matter most: secure coding and vulnerability scanning during development, robust authentication, encrypted and access-controlled data storage, and properly configured cloud infrastructure. Working through this list does not guarantee a completely invulnerable application, but it addresses the vulnerabilities that are exploited most frequently in real-world attacks.

If you are evaluating an outsourced development partner, this checklist serves as a useful baseline for assessing their security maturity. A vendor that cannot speak concretely to these controls has not made security a priority. unicrew works under an ISO 27001:2022 certified information security management system that covers the whole company. If you need help identifying gaps in your application's security posture, our penetration testing team can run a structured assessment and prioritize remediation steps.

Sources

• IBM, Cost of a Data Breach Report 2026
• Verizon, 2026 Data Breach Investigations Report, Executive Summary
• OWASP, Top 10:2025
• Michael O'Brien, Web Developer Security Checklist (2017), the source of several items in the checklists above