Is there a standard checklist to audit an organization's website security?

  • short answer is 'no' - is there something you are interested in specifically? – schroeder Aug 29 '16 at 15:19

There is the OWASP checklist here: OWASP Testing Checklist

Recently some people have collaborated on a checklist for developers: A practical security guide for web developers

I found the second one to be more useful myself, although the OWASP list has been around for much longer.

  • Whilst OWASP could be called a reliable resource and is likely to stick around, a Github link is really not ideal at all for StackExchange. As a rule of thumb, if a document can be cited (with a title, author names, publisher, etc.) then it is stable enough to be simply quoted. Otherwise, you must summarise the content of the document into your answer. – Steve Dodier-Lazaro Aug 29 '16 at 8:52
  • @SteveDL Yes I understand that, but the Github project recently got a lot of attention and for good reason as it is much more accessable than the OWASP list. – Yorick de Wid Aug 29 '16 at 8:56
  • 3
    That's not the point I was trying to make. SE is interested in building resources that will continue to be useful over decades. OWASP has existed for a long while and is kind of a "Web institution". The link you posted will probably not die any time soon. If it does, people can still easily google "OWASP testing checklist". Your second link, however, is one month old. Heck, Github might die in 5 years' time for all we know. That group might give up. They might change names. It's highly unlikely the URL will still work 10 years from now. – Steve Dodier-Lazaro Aug 29 '16 at 8:58

Not the answer you're looking for? Browse other questions tagged or ask your own question.