Website Security Checklist 2026: Is Your Website or Web App Actually Secure?
Security is neglected until someone exploits it. A six-point checklist for websites (HTTPS, updates, WAF, backups) and a six-point checklist for web applications (privacy rules, role enforcement, API credentials, webhook validation) with the free audit that reveals what is missing.
Why Security Is the Most Neglected Part of Web Development
Website and web application security is neglected in most projects. Security features do not appear in demos. Security problems do not appear until someone exploits them. And when a security breach occurs — whether on a public website or a web application — the cost is immediate and severe: customer data exposed, legal liability incurred, reputation damaged, and enterprise deals lost. This checklist covers the security requirements for both websites and web applications in 2026.
For Public-Facing Websites
HTTPS with a valid SSL certificate
Every website must serve over HTTPS. An HTTP website displays a ‘Not Secure’ warning in Chrome browsers and ranks below HTTPS sites in Google search. Most hosting providers include free SSL certificates via Let’s Encrypt. Verify: your URL begins with https:// and shows a padlock icon.
Updated CMS and plugins
WordPress websites with outdated core software, themes, or plugins are the most commonly compromised websites on the internet. Every plugin update is potentially a security patch. Enable automatic updates for WordPress core. Review and update plugins weekly. Remove unused plugins.
Strong admin credentials
Do not use ‘admin’ as your WordPress username. Use a unique username and a password generated by a password manager (16+ characters, random). Enable two-factor authentication on your CMS admin account. Most WordPress compromises begin with stolen or guessed admin credentials.
Web Application Firewall (WAF)
A WAF filters malicious traffic before it reaches your website. Cloudflare’s free plan includes basic WAF protection and significantly reduces malicious request volume. For WordPress: the Wordfence plugin includes a WAF. Enable it before your website receives meaningful traffic.
Regular backups with off-site storage
Your hosting provider’s server backup is not sufficient. A hacker who gains access can delete server backups. Keep copies of your website files and database in a separate location (Google Drive, S3, or a dedicated backup service). Test restoring from backup at least quarterly.
Contact form spam protection
Unprotected contact forms are exploited by spam bots to send bulk emails through your server, which can blacklist your sending domain. Add Google reCAPTCHA v3 (invisible) or a honeypot field to every form. Monitor form submissions for bot patterns.
For Bubble.io and Custom Apps
Privacy rules on every data type
The most critical web application security control. Without privacy rules, any authenticated user can query any data type via the application’s API. Set privacy rules before any data is created. Test with the two-browser isolation test before every production deployment.
Role enforcement in workflows
Hiding buttons from non-admin users is not security. The workflow behind the button must also have a role check on Step 1. Without this, any user who can call the workflow API directly can perform admin actions regardless of their UI role.
All API credentials marked private
Any API key stored in an API Connector call that is not marked ‘Private’ travels from the user’s browser to the external service. Every user who opens browser developer tools sees the key. All credentials must be marked private to force server-side execution.
Stripe webhook signature validation
Stripe sends webhooks to your application when billing events occur. Any system that processes Stripe webhooks without validating the webhook signature is vulnerable to fake payment confirmations. Validate the Stripe-Signature header before processing any webhook payload.
Input validation before processing
Any text input from a user should be validated before it is stored or processed. Minimum length, maximum length, and format validation on every input field. This prevents garbage data from corrupting your database and reduces the attack surface for injection attempts.
Audit logging for sensitive actions
Log every sensitive action (record deletion, admin action, billing change, user invitation) to an append-only audit log. The audit log allows investigation of security incidents and demonstrates to enterprise clients that security actions are tracked.
Free Website and App Tech Audit — 30 Minutes, Zero Cost
Athar Ahmad personally reviews your website or web application and tells you exactly what is wrong, what is at risk, and what to fix first. No obligation. No sales pitch. Just clear answers.
- Security and privacy rule assessment
- Performance and speed bottleneck identification
- Architecture quality review
- Prioritised remediation roadmap
Q: How do I know if my website has been compromised?
Signs of compromise: unexpected admin accounts you did not create, content you did not write appearing on your site, your site redirecting visitors to other websites, Google Search Console showing malware warnings, your email domain appearing on spam blacklists. Check Google Search Console weekly for security issues.
Q: How do I know if my Bubble.io web application is secure?
Run the two-browser isolation test: two browser sessions, two accounts in different organisations, navigate all pages as User B and confirm zero records from User A’s organisation are visible. Then test the Bubble Data API directly with User B’s token to confirm privacy rules apply.
Q: What does a web application security audit cost?
SA Solutions’ free Tech Audit covers the primary security controls for Bubble.io applications. For more comprehensive security assessments (penetration testing, vulnerability scanning, compliance documentation), expect $500-$3,000 depending on scope.
Ready to Build or Fix Your Website?
Two paths: a Free Tech Audit for websites and web apps that need assessment, or a Discovery Sprint to scope your new website project correctly before a single line is built.
