Page Title

Security Guidelines 2021

What should I do to make my website secure if I am a web developer?

Never use inline Javascript. Always use a separate external file loaded from the same domain.
Never use inline or embedded CSS-Files. Always use a separate external CSS file loaded from the same domain.
Never put an Attribute like onsubmit into an HTML-Tag. Always use the addEventListener method to add an Event Listener to a tag.
Avoid at all costs to integrate scripts or styles from a third party. Download the script if you really need it and host it locally.
If you care about the privacy of your users, don't screw around. Host as much resources locally as you can. Images, Scripts, Videos, PDF, or other files the user needs access to. The fewer requests the user has to make to third parties, the better the user is protected from potential threats and attacks.
Try to avoid Frameworks and Libraries. If you can't avoid them, at least host them locally and do not embed any scripts or fonts from third party.
You always have to validate every single request if some important data is going to be modified.
Always check if the user is authenticated first, then check for authorization and if all checks were successfully validated only then perform an action or fullfill a request.
Always use a slash at the end of a URL that doesn't end with a file. Like https://sololearn.com/Login/ and not https://sololearn.com/Login. On files just use https://sololearn.com/Login/index.html.
Always use constants if the value is not going to be changed.
Avoid unnecessary redirects. If you know /Login will redirect the user to /User/Login don't redirect the user to Login/ but redirect the user directly to /User/Login/.
Do not give away privileges just for convenience. Even the admin does not need all privileges. Why should the admin be able to delete the whole website right? So there should be no option to make dangerous, persistent data modifications even for the admin.
When comparing values use === instead of == and use !== instead of !=.
Hands off from features that you don't need. Only store values that are really necessary for the website to run. Less is more!
In 2021 there is really no excuse to not use HTTPS. If you can't set up a website with HTTPS on your own, ask an administrator of your trust.
Always use https:// in hyperlinks and never http:// even if the website redirects HTTP-Requests to https://.
On Sign In failure do not give back messages like "Username does not exist" or "Password is wrong". Better is "Login is invalid" if Username/E-Mail and Password don't match.
Do not try to hide/obfuscate the hyperlink to resources like images and other pages. Remember: Security does not come from obscurity but it comes from transparency.
Logins should not be valid indefinitely. The user must be logged off after a certain period of inactivity.
Google CAPTCHAS and hCaptchas are the worst. Stay the hell away from them.
Don't use URL shortened links on your website.

I am open to suggestions for improvement and constructive criticism. If you find any spelling mistakes, let me know in the comments, then I will correct them. Thank you developers for making the web a better and safer place for everyone by following these guidelines. Have a great day.

Updated 2021-05-31

Security guidelines for web developers