---
title: Security checklist - developing a website
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

This is a design checklist – things you should keep in mind while [developing websites](https://docs.kentico.com/13/securing-websites/developing-secure-websites.md).

## User inputs

| Check | Description                                                                                      |
| ----- | ------------------------------------------------------------------------------------------------ |
|       | User inputs are checked for type, length, and content.                                           |
|       | User inputs with arithmetic operations are checked and validated for minimum and maximum values. |
|       | All user inputs are validated on the server-side as well as on the client-side.                  |
|       | Values stored in hidden form fields are validated properly.                                      |

## Attack prevention

| Check                                  | Description                                                                                                                                                                                                 |
| -------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Cross-site scripting**               |                                                                                                                                                                                                             |
|                                        | User inputs are escaped and validated.                                                                                                                                                                      |
|                                        | Content is encoded before it is rendered on a page.                                                                                                                                                         |
|                                        | Strings from external sources are encoded using the _HTMLHelper.HTMLEncode()_ method.                                                                                                                       |
|                                        | URL parameters are sanitized using the _QueryHelper.GetText()_ method.                                                                                                                                      |
|                                        | Values from external sources rendered as part of JavaScript code are encoded using _CMS.Base.Web.UI.ScriptHelper.GetString()_.                                                                              |
|                                        | Cookies are configured as HTTP-only.                                                                                                                                                                        |
| **SQL injection**                      |                                                                                                                                                                                                             |
|                                        | SQL parameters are used for dynamic parts of SELECT, INSERT, UPDATE, and DELETE queries.                                                                                                                    |
|                                        | The exec() function is not used in SQL code.                                                                                                                                                                |
| **Cross-site request forgery**         |                                                                                                                                                                                                             |
|                                        | Actions are performed using POST requests, not GET.                                                                                                                                                         |
|                                        | The _ValidateAntiForgeryToken_ attribute is added to your action methods, and security tokens are generated by calling the _@Html.AntiForgeryToken()_ method in your views that post to the action methods. |
| **LDAP injection**                     |                                                                                                                                                                                                             |
|                                        | User inputs for LDAP queries are sanitized before execution.                                                                                                                                                |
| **Unvalidated redirects and forwards** |                                                                                                                                                                                                             |
|                                        | Any custom redirects to URLs obtained from untrusted inputs are validated. The _System.Web.MVC.UrlHelper.IsLocalUrl_ method is used to validate inputs before performing redirects.                         |

## Other issues

| Check           | Description                                                                                                                                   |
| --------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
|                 | User accounts are secured against all types of attacks.                                                                                       |
|                 | Error messages in the UI are configured so that they show only basic information and the whole information is logged only into the Event log. |
| **File upload** |                                                                                                                                               |
|                 | Name, length, type, and content of files are checked upon file upload.                                                                        |
| **Logging**     |                                                                                                                                               |
|                 | All critical activities on the website are logged.                                                                                            |
|                 | The website does not allow unhandled exceptions to occur.                                                                                     |