Well lets assume that someone is intending to build a website that will contain THOUSANDS of sensitive records such as credit cards etc.

What would be a good checklist that would ensure that the website has the maximum of the security necessary to operate such a website safely?

  • 5
    – Adi
    Dec 12, 2013 at 8:02
  • 12
    Also, if you're asking such questions ("checklist for MAXIMUM website security"), you're probably not the right guy for the job (neither am I, if that makes you feel any better). Get an expert professional!
    – Adi
    Dec 12, 2013 at 8:54
  • 1
    Maximum security is a bad goal. The NSA just started to prevent a lot of operations from being done by a single sys admin. Most companies are okay with trusting their sys admins not to leak the customer credit card database. The goal should be to have reasonable security and follow best practices.
    – Christian
    Dec 26, 2013 at 2:09
  • 1
    It takes teamwork for maximal security. You hire people with expertise for each aspect and they have their own checklists. Dec 26, 2013 at 2:35

3 Answers 3


There are a lot of checklists in the security world. I recommend you check OWASP.


Although this question is a bit broad, there actually is a reasonable answer. There is no one checklist, however NIST has a checklist repository which has OS and software configuration checklists. There's also several organizations which may also provide not only checklists but standards and guidance:

  • NIST
  • SANS
  • PCI

Using HTTPS with strong ciphers should be good enough for your website to protect financial information during transactions. You should be more worried about how you securely store personal information in your web server. More like firewalls, data encryption, access controls to those files and using strong admin passwords.

Not the answer you're looking for? Browse other questions tagged .