I'm working on site security for my website. However I'm having trouble making the security better.

How can I increase the site security? How can I increase user security?

Now, when I say user security, I mean like users themselves being able to build up their own security to keep their account(s) safe.

closed as too broad by Anders, schroeder May 11 '16 at 2:52

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • If you want a better answer on who to do to make your site more secure we need to know more about it. We can answer about how to make a user more secure though, but there isn't much. – Robert Mennell May 10 '16 at 22:34
  • This question is really, really broad with a multitude of possible answers. Is there some specific aspect of your site's security you are most interested in? – schroeder May 10 '16 at 22:38
  • Have you looked at other sites that have great user account security and tried to implement what they do (2FA, password reset processes, CAPTCHA, etc.)? – schroeder May 10 '16 at 22:39
  • Don't forget hashing passwords – Robert Mennell May 10 '16 at 23:34
  • @Anthony: It would help to know which language are you using, and what kind of steps are you taking care of. But this will help you to get started: Web_Application_Security_Testing_Cheat_Sheet – lepe May 11 '16 at 1:00

Bad news, you can't do much!

You can never trust a user, their input, or anything else about them. The most you can trust is they are using your service. Even then you can't always trust that they aren't being impersonated.

For site security there is the gamut of usual suspects(Use SSL and make sure you get a good grade on ssllabs, sanitize input, secure SSH access and admin access to specific static IPs, so forth and onward to infinity and beyond, too broad of a question to answer here), however increasing a user's security on their end is impossible. You can't force a user to do anything, so the best you can do is make your site and database as secure as possible.

Really the most you can do for a user is enforce strong passwords. Even then they might try to get around it.

Not the answer you're looking for? Browse other questions tagged or ask your own question.