The Website Security Audit Checklist

Start with the basics

Before anything fancy, verify:

1. TLS 1.2+ only, forward-secret ciphers
2. HSTS with includeSubDomains and preload
3. Content-Security-Policy scoped tightly
4. X-Frame-Options: DENY (or CSP frame-ancestors 'none')
5. Referrer-Policy: strict-origin-when-cross-origin

Then the OWASP layer

The OWASP Top 10 is not a wish list, it's the minimum. Broken access control, cryptographic failures, and injection remain the three most common findings we see across engagements. Every one of them is preventable with disciplined engineering.

Finally, the infrastructure

Check DNS, check your CDN's WAF rules, check your rate limits. And log everything — attackers exploit the gaps between systems that don't share telemetry.