Web security
A practical route through PHP2Shell, XSS, CSRF, forms, browser storage, HTTP headers and dependencies for building and maintaining websites with fewer avoidable risks.
What a developer should review to improve website security
Web security reduces risk through several layers: validate data on the server, handle every output according to its context, check permissions for every action, protect sessions and limit what the browser may execute. HTTPS is essential, but it cannot fix XSS, broken authorisation or a compromised dependency on its own.
This path is for frontend developers who want security to be part of their process without pretending that a checklist replaces a professional review. It starts with everyday decisions about forms, cookies, storage, dependencies and deployment, then connects each one to a more focused guide.
Recommended reading path
Start with the overall model, then move towards the points where data, sessions and configuration change the risk.
Understand the limits of the frontend
The interface can guide people and validate for a better experience, but the browser remains under the user’s control. These guides separate validation, output encoding and decisions that belong on the server.
Protect sessions and browser data
Choosing between cookies and web storage changes the threat model. The goal is to understand what a script can read, when credentials travel and which defence an authenticated action needs.
Harden the release
Headers reduce unnecessary browser capabilities, dependencies expand the chain of trust, and the server runtime needs maintenance too. Each one must be reviewed against the real application rather than a copied generic configuration.
A minimum baseline before release
- Validate the shape, meaning and limits of every incoming value on the server.
- Render untrusted data as text and sanitise only the HTML that genuinely needs to be allowed.
- Check authorisation for the resource and action, not only whether a session exists.
- Keep credentials and sensitive data out of localStorage and sessionStorage.
- Configure cookies, HTTPS and headers for the architecture, then test the deployed response.
- Review dependencies, installation scripts and secrets before every release.