---
title: Security checklist - designing a website
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

This is a design checklist – facts you should consider before you begin [developing your website](https://docs.kentico.com/13/securing-websites/developing-secure-websites.md).

## Security requirements

| Check | Description                                                                                                                                                                                                                                                                                                                                       |
| ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|       | I know how critical security will be for the website (whether it is a blog, corporate website, e-shop, bank application, etc.).                                                                                                                                                                                                                   |
|       | I know if my website will need any special certifications ([PCI](https://docs.kentico.com/13/securing-websites/designing-secure-websites/pci-compliance.md), [Safe Harbor](https://www.enisa.europa.eu/topics/threat-risk-management/risk-management/current-risk/laws-regulation/data-protection-privacy/safe-harbor-privacy-principles), etc.). |
|       | I know which special requirements will be imposed on the website (custom authentication, premium sections, various types of administrators, etc.).                                                                                                                                                                                                |
|       | I have an idea about the number of users accessing the system, which roles the users will be grouped under, which sections of the website will be accessible only to authenticated users, and so on.                                                                                                                                              |
|       | I know how large the scope of planned custom development will be.                                                                                                                                                                                                                                                                                 |
|       | I know if security issues will be addressed during the development phase (possibly with [threat modeling](http://en.wikipedia.org/wiki/Threat_model)) or after the website has been implemented.                                                                                                                                                  |

## Environment

| Check | Description                                                                                  |
| ----- | -------------------------------------------------------------------------------------------- |
|       | I know what environment I will deploy my website to (private server, web hosting, or cloud). |
|       | I know the security restrictions of the live environment.                                    |
|       | I know what settings I will have access to in the live environment (which IIS settings).     |

## Xperience

| Check | Description                                                                                                                                                                                                                                                                                                                                               |
| ----- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|       | I have mapped my security requirements to Xperience (for example, if you want to apply a [password policy](https://docs.kentico.com/13/securing-websites/designing-secure-websites/securing-user-accounts-and-passwords/password-strength-policy-and-its-enforcement.md), then you know whether the default Xperience functionality suits your purposes). |
|       | I am familiar with all Xperience protections and I know how to utilize them.                                                                                                                                                                                                                                                                              |
|       | I know which applications and services my website will need and which I can uninstall or disable.                                                                                                                                                                                                                                                         |
|       | I know how to use the Xperience API securely.                                                                                                                                                                                                                                                                                                             |
|       | I have designed all custom authorization and authentication protections and I know how to implement them in Xperience.                                                                                                                                                                                                                                    |