Pre-Launch Security Checklist for Web Apps
The condensed version: 20 items to verify before going live, organized by priority.
Key Takeaway
Before launching a web app, verify at minimum: HTTPS with valid certificate, security headers (CSP, HSTS, X-Frame-Options), no exposed secrets or debug endpoints, parameterized database queries, rate limiting on login, and CSRF protection on all forms.
Must-Have (Ship Blockers)
Don't launch without these. Each one represents a real, exploitable vulnerability if missing.
- HTTPS with a valid TLS certificate. Use Let's Encrypt. It's free and auto-renews.
- HTTP redirects to HTTPS. 301 redirect, not 302. Every page, not just the homepage.
- HSTS header is set. Prevents SSL stripping attacks on first visit.
- Content-Security-Policy header. Blocks XSS attacks. Start with
default-src 'self'. - No exposed secrets in code. Grep for API keys, passwords, tokens. Use environment variables.
- Debug mode is off. No stack traces, no verbose errors, no
/debug/endpoints. - Database queries are parameterized. Zero string concatenation in SQL.
- CSRF protection on all forms. Login, registration, payment, settings. Every state-changing form.
- Passwords hashed with bcrypt/Argon2. Never plaintext, MD5, or unsalted SHA.
- Sensitive files return 404.
.env,.git/config,docker-compose.yml. Not accessible via URL.
Should-Have (First Week)
Handle these within the first week. They reduce your attack surface and improve trust.
- Rate limiting on login and API endpoints. Prevents brute force and abuse.
- Cookie flags: Secure, HttpOnly, SameSite. Prevents session theft via XSS and CSRF.
- X-Frame-Options and X-Content-Type-Options headers. Two-line config, significant protection.
- CORS configured with specific origins. No
Access-Control-Allow-Origin: *. - Privacy policy published. Required by GDPR if you have EU visitors. Link from footer.
- Error pages don't leak information. Custom 404 and 500 pages with no technical details.
- Admin panel is not publicly accessible. IP restriction, VPN, or separate domain.
Nice-to-Have (First Month)
These improve your security posture further and prepare you for scale.
- Security event logging. Log login attempts, access denials, and errors. Store logs separately from the application.
- Dependency audit in CI. Run
npm auditorpip auditon every build. Block deploys with critical vulnerabilities. - Automated security scanning after deployments. Run ismycodesafe.com after each release to catch regressions.
For the full 50-item version with detailed explanations, see The Developer Security Checklist.
Check your website right now
110 security checks in 60 seconds. Free, no signup required.
Scan My Website (Free)ismycodesafe.com Security Team
We run automated security scans on thousands of websites daily, combining static analysis, SSL/TLS inspection, header auditing, and CVE lookups. Our team tracks OWASP, NIST, and evolving compliance requirements (GDPR, NIS2, PCI DSS) to keep these guides accurate and practical.