In my opinion the best method is to perform a pentest. Ethical hacking performed by professionals will give you the flaws of your website.
Anyway, some common checks are:
- Have your website ssl with a good certificate?
I mean a certificate made by an authorized entity, not a self-signed certificate.
- Do you have HSTS activated?
This is to automatically redirect clients requesting the page in plain (http) to the secure (https) version.
- Have my website the security headers?
The usual protections against clickjacking, XSS and others. Check this: https://geekflare.com/http-header-implementation/
- Are you sure the content displayed is the desired content to show?
Check if there are "residual" files on the server's browseable folders. Check if the private part of the website can't be accessed directly by url bypassing login... all of the basic checkings.
- Are you sure your server version and technology is up-to-date?
Usually, old versions of any webserver or technology (Apache, php, wordpress, nginx, etc) are vulnerable to some attacks.
- Do you have any kind of protection against DoS?
In your case, if the website is hosted on AWS you can talk to your provider (Amazon) for this service.
- Execute a SAST analysis on your code using a source code scanner tool. <- I added this to answer to Wealog asking for this on his answer.
Checkmarx is a very good option but it's expensive. HP Fortify can do the job too but is expensive too. For mobile apps there are some free solutions like androbugs, drozer or mobsf. For other kind of apps I don't know a good tool for free.
This can be valid to start. But remember, pentest is the key in my opinion.