---
title: Security checklist - developing a website
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

This is a design checklist – things you should keep in mind while [developing websites](https://docs.kentico.com/k81/securing-websites/developing-secure-websites.md).

## User inputs

| Check | Description                                                                                      |
| ----- | ------------------------------------------------------------------------------------------------ |
|       | User inputs are checked for type, length and content.                                            |
|       | User inputs with arithmetic operations are checked and validated for minimum and maximum values. |
|       | All user inputs are validated on server side as well as on client side.                          |
|       | Values stored in hidden form fields are validated properly.                                      |

## Attack prevention

| Check                          | Description                                                                                                        |
| ------------------------------ | ------------------------------------------------------------------------------------------------------------------ |
| **Cross-site scripting**       |                                                                                                                    |
|                                | User inputs are escaped and validated.                                                                             |
|                                | Content is encoded before it is rendered on a page.                                                                |
|                                | Strings from external sources are encoded using the HTMLHelper.HTMLEncode() method.                                |
|                                | URL parameters are sanitized using the QueryHelper.GetText() method.                                               |
|                                | Values from external sources rendered as part of JavaScript code are encoded using ScriptHelper.GetString().       |
|                                | Cookies are configured as http-only.                                                                               |
| **SQL injection**              |                                                                                                                    |
|                                | SQL parameters are used for dynamic parts of SELECT, INSERT, UPDATE and DELETE queries.                            |
|                                | The exec() function is not used in SQL code.                                                                       |
| **Cross-site request forgery** |                                                                                                                    |
|                                | Actions are performed using POST requests, not GET.                                                                |
|                                | View state mac validation is enabled globally in the web.config file.<br>`  <pages enableViewStateMac="true" />
 ` |
| **LDAP injection**             |                                                                                                                    |
|                                | User inputs for LDAP queries are sanitized before execution.                                                       |

## Other issues

| Check           | Description                                                                                                                                   |
| --------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
|                 | User accounts are secured against all types of attacks.                                                                                       |
|                 | Error messages in the UI are configured so that they show only basic information and the whole information is logged only into the Event log. |
| **File upload** |                                                                                                                                               |
|                 | Name, length, type and content of files is checked upon file upload.                                                                          |
| **Logging**     |                                                                                                                                               |
|                 | All critical activities in the website are logged.                                                                                            |
|                 | The website does not allow unhandled exceptions to occur.                                                                                     |