Digital threats are more prevalent than ever before. We asked industry experts to share one website security practice that they initially thought was unnecessary but later realized was crucial. Here are their suggestions for safeguarding your digital assets and ensuring the integrity of your web presence.
- Implement Automated Password Expiration Policies
- Prioritize Controlling Source Code Access
- Adopt a Web Application Firewall
- Implement Subresource Integrity Checks
- Enforce a Strict Update Schedule
- Regular Backups Ensure Business Continuity
- Prioritize Two-Factor Authentication
- Validate JSON Web Tokens Properly
- Adopt a Zero-Trust Architecture
- Implement Content Security Policies
- Enforce Role-Based Access Control
- Conduct Regular Security Audits
12 Website Security Essentials You Shouldn’t Ignore
Implement Automated Password Expiration Policies
As a developer, I initially dismissed the importance of regular password rotation because I thought strong passwords were enough, until we discovered unauthorized API calls from compromised admin credentials that hadn’t been changed in months. That incident led me to implement automated password expiration policies and session timeouts across all our SaaS platforms, which has prevented similar issues for the past two years.
Joshua Odmark
CIO and Founder, Local Data Exchange
Prioritize Controlling Source Code Access
Historically, I would outsource my website builds to the lowest bidder, focusing solely on cost and delivery time without much thought about security. At the time, I didn’t consider the importance of controlling the source code or understanding who had access to its development. Over time, however, I learned that this lack of oversight left my projects vulnerable to supply chain attacks and unauthorized code modifications. Incidents like malicious code insertion or compromised credentials highlighted the risks of entrusting critical code to third parties without proper checks.
Now, I prioritize controlling the source code and ensuring only authorized, vetted developers have access to the repository. Implementing practices like strict access controls, multi-factor authentication, and continuous monitoring has become essential to safeguard my projects. Understanding who has access and maintaining oversight throughout the development process is no longer just an afterthought—it’s a critical component of protecting against modern threats. This shift has not only strengthened the security of my projects but also ensured greater peace of mind for both me and my clients.
Brian Gallagher
CEO, CodeLock
Adopt a Web Application Firewall
I initially thought implementing a Web Application Firewall (WAF) was overkill for our site. We had SSL certificates and basic security measures in place, and I assumed those were enough to protect client data. However, we experienced a wake-up call when an attempted SQL injection attack targeted our client login portal. While the attack was ultimately unsuccessful, it exposed vulnerabilities that could have led to a breach of sensitive financial data.
Realizing the stakes, we implemented a WAF to provide an additional layer of protection against threats like SQL injection and cross-site scripting (XSS). This decision not only safeguarded our clients’ data but also ensured the website remained operational during attempted attacks, preventing any downtime. The WAF adapted to new threats as they emerged, keeping our platform secure as we scaled and added more features.
Since adopting this measure, we’ve noticed a significant reduction in malicious traffic and have maintained a flawless security record, which has bolstered client trust. Knowing their data is secure, our clients are more confident in using our services, reinforcing our reputation for reliability and professionalism. In hindsight, the WAF wasn’t just a good decision—it became a cornerstone of our commitment to security and trustworthiness.
Habib Rkha
Founder, QCADVISOR
Implement Subresource Integrity Checks
We render web pages and scholarly papers into accessible audiobooks, and in doing so, we process a lot of third-party scripts—analytics, marketing tags, UI enhancements, you name it.
One security practice I initially brushed off was implementing Subresource Integrity (SRI) checks for those external scripts. It sounded like “nice-to-have” overhead rather than a must-have measure. Then, we discovered a suspicious script trying to siphon user data on our staging site. It turned out one of our analytics tags was compromised at the source, and it could have gone unnoticed until we had a serious data breach on our live platform.
How the Realization Occurred:
- We were consistently getting random session timeouts in our staging environment, so we checked the logs. We found that these strange requests were being caused by a modified third-party script.
- If we had supported SRI initially, the browser would have refused to run any script whose hash did not match our validated version-preventing the hijack even before it loaded.
Why It’s Important:
- Invisible Threats: Third-party scripts tend to get updated without your awareness. One little compromise on their part can become your issue in seconds.
- Data Protection: For a site like ours that processes user data, SRI is like a tamper-evident seal. It ensures only the original, unmodified script can run.
- Early Detection: If your site suddenly rejects a script that was previously valid, that’s an instant red flag to investigate—potentially saving you from a large-scale incident.
It turns out, “locking down” third-party scripts isn’t a precautionary measure; it’s a front-line defense.
Derek Pankaew
CEO & Founder, Listening.com
Enforce a Strict Update Schedule
I used to think that regularly updating plugins, themes, and software was more of a best practice rather than a critical security measure. The idea of frequent updates seemed more like an inconvenience, especially when updates occasionally caused minor compatibility issues. However, my mindset completely shifted when a client’s WordPress site was compromised due to an outdated plugin.
The vulnerability existed in a widely used plugin that had an unpatched remote code execution flaw. Attackers exploited this to inject malicious scripts into the website, leading to unauthorized access and spam injections. When we traced the breach back to the outdated plugin, it was a wake-up call, this wasn’t just a minor issue, it was an open door for hackers.
Now, I enforce a strict update schedule for every website I manage, ensuring that plugins, CMS platforms, and server software are patched as soon as security updates are released. Additionally, I use automatic vulnerability scanning tools to monitor outdated software and check for potential threats. This experience taught me that updates are not optional, they are an essential line of defense against constantly evolving cyber threats.
Darryl Stevens
CEO, Digitech Web Design
Regular Backups Ensure Business Continuity
When I first started my business, I didn’t fully appreciate the importance of regular backups. I initially thought it was an extra step that could be skipped in the interest of saving time and resources. However, the need for reliable backups became painfully clear when we faced an unexpected server issue that caused some of our customer data to become temporarily inaccessible. This event made me realize that securing business-critical data was non-negotiable.
Implementing a solid backup system has since allowed us to recover quickly from any technical issues, protecting our inventory, order histories, and customer information. It also ensures that our website runs smoothly without disruptions, which is critical for maintaining customer trust. We’ve seen the impact of this practice in how much more resilient we are to cyber threats and system failures, with minimal downtime. Regular backups have ultimately been a vital safeguard, helping us maintain continuity and prevent any long-term damage to our business reputation.
Juan Gonzalez
CEO, Best Used Gym Equipment
Prioritize Two-Factor Authentication
One security practice that I initially thought was unnecessary is implementing two-factor authentication (2FA) on the website. In my early days, I thought 2FA was not a necessary thing, and it’s also a hassle since you need to verify either using a phone or email, which provides an unnecessary additional step without getting any benefit from it.
However, this changed when, after my website got hacked, despite having a strong password, the hacker still managed to access my website. The turning point came when I saw how 2FA could have stopped the attack. By requiring users to verify their identity using something they know (password) and something they have (e.g., a phone or authentication app), 2FA adds a critical second layer of security. Even with stolen credentials, the attacker couldn’t bypass the additional verification step.
Ever since then, I have been prioritizing 2FA in every single website project. By implementing it, it not only reduces the risk of getting hacked but also builds users’ trust. 2FA provides a robust defense against unauthorized access. This realization showed me that security isn’t just about prevention but also mitigating the risk of getting breaches, making 2FA a valuable tool in modern cybersecurity.
Mei Ping Mak
Director of SEO and Web, Weave Asia
Validate JSON Web Tokens Properly
One security practice I initially underestimated was properly validating JSON Web Tokens (JWTs). Early on, I thought JWTs were inherently secure because they were signed, and I didn’t pay much attention to proper validation on the server side. However, I later realized how crucial it is to validate the token’s signature, expiration time (exp), and claims properly. This realization hit me while debugging an issue where a poorly implemented JWT setup allowed expired tokens to access sensitive resources. The system was checking only for the presence of a token, not verifying its integrity or claims. It became clear that JWTs are secure only if every aspect of the token is rigorously validated.
Using tools like jwtdecoder.com to inspect tokens and verify their claims became a go-to practice for me. It’s not just about creating JWTs but also about understanding what they contain and ensuring they are used securely in your application. By validating tokens correctly, you prevent common vulnerabilities like token replay attacks or unauthorized access from tampered tokens. This experience reinforced the importance of secure JWT implementation, teaching me that even seemingly small oversights can lead to significant security risks.
Waleed Qadeer
Software Engineer, Decode Fix
Adopt a Zero-Trust Architecture
One website security practice I initially thought was unnecessary was adopting a zero-trust architecture. It seemed like overkill when traditional firewalls, VPNs, and access controls were already in place. However, the realization hit during a phishing incident where compromised internal credentials bypassed perimeter defenses entirely.
This experience underscored a fundamental truth: trust is the biggest vulnerability in cybersecurity. By shifting to a zero-trust approach—where every access request is verified, regardless of origin—we’ve not only strengthened our defenses but also built resilience against evolving threats. It’s a practice that reshaped how we view security, moving from reactive fixes to proactive, strategic prevention.
Anupa Rongala
CEO, Invensis Technologies
Implement Content Security Policies
A few years ago, when our team was working on a project for a client, we unfortunately neglected Content Security Policies because it looked redundant and overly complex paired with HTTPS, firewalls, and regular penetration tests.
One day, despite all our security steps, the client’s site became the target for cross-site scripting attacks. As it turned out, we realized the importance of a multi-stage defense strategy—in particular, the usage of CSPs—that could mitigate the force of attack and prevent the execution of unauthorized scripts even if hackers tried to strike the site’s code.
Since then, implementing Content Security Policies has become the essential measure for our developers against clickjacking, XSS, and other threats. Now, CSPs empower us to proactively secure applications, ensuring user trust and the integrity of our clients’ websites. After we started using CSP on a regular basis, the frequency of successful hacker attacks on the sites of our clients decreased by 25%. What’s more, even in cases where the site was attacked, it was easier for us to rebuild it.
Dmytro Romanchenko
CEO, Syndicode
Enforce Role-Based Access Control
One website security practice we initially underestimated was enforcing strict role-based access control (RBAC) for internal teams. At the time, we thought it was unnecessary, especially since everyone in a smaller team tends to juggle multiple roles. It felt easier to allow broad access across systems to avoid slowing anyone down. Then, we faced an incident where sensitive configuration files were accidentally exposed during deployment. It wasn’t malicious, just a simple mistake, but it was a clear reminder of how unrestricted access can lead to serious risks.
After that, we mapped out clear roles and implemented the “least privilege” principle. For instance, developers no longer had direct access to production servers unless it was time-limited and essential. We also added logging and alerts to track changes and catch potential issues early. Surprisingly, this didn’t just improve security; it made responsibilities clearer, reduced errors, and boosted accountability across the team. That experience taught us that security isn’t just about protecting against outside threats. It’s just as important to safeguard against avoidable internal risks, even in a smaller, tight-knit team.
Vikrant Bhalodia
Head of Marketing & People Ops, WeblineIndia
Conduct Regular Security Audits
One practice that stands out as a key lesson learned is the importance of regular security audits and penetration testing.
In the early days, like many others, we focused heavily on building robust systems and implementing firewalls, often viewing comprehensive security audits as an unnecessary expense, especially for smaller projects. We believed that if the initial build was secure, we were essentially covered.
However, 10 years ago, we had a client in the e-commerce sector who experienced a minor security breach. While the damage was limited, it was a wake-up call. We realized that websites are constantly evolving with new features, updates, and integrations, each potentially introducing new vulnerabilities. Additionally, the threat landscape is always changing, with hackers developing sophisticated methods to exploit even seemingly minor weaknesses.
This incident prompted us to implement regular security audits and penetration testing across all our projects. These tests simulate real-world cyberattacks, helping us identify vulnerabilities before they can be exploited by malicious actors. What we initially perceived as an unnecessary expense, we now recognize as a crucial investment in protecting our clients’ businesses and our reputation.
This experience has significantly shaped our approach to website security. We now prioritize a proactive, continuous security posture rather than a reactive one.
Rohit Maheshwari
Co-Founder, NMG Technologies
