I'm building a web service (a control panel for clients) (PHP on linux apache) and trying from the design to make it the most secure as I can,
Can anyone provide me with some kind of a check-list of things I need to be focusing on?
I already implemented:
- SQLi protection,
- per session CSRF token,
- secure password hashing storing to database with php 5.5 password_hash(with need_rehash check),
- added recaptcha for all spam robots,
sessions manager for the user (view who logged in to my account and
close remote sessions & alert if someone accessed my account).
- SSL certificate, full communication over HTTPS. (i redirect all http -> https)
Do I need some kind of auto ban IP system?
Failed login IP banning & logging?
Any linux-server security modifications? I did not modify anything yet
How do I protect my website from all spam bots/spiders? identify&ban
It will be helpful if someone can prove a guideline/checklist to all security points for a website, to go an check/secure one by one...
I think my service is secure then the most... but clearly it's not gonna change the fact that there are some skilled people chat can hack anything... - I do want to make it a bit of a challenge if someone try messing with my system... I want a website service that is more secure then others.