Web Application Security Checklist for UK Businesses in 2026

How Secure Is Your Web Application? Start Here.

Most businesses assume their web application is reasonably secure. Most businesses haven't checked.

This checklist covers the key security controls that an external automated security scan will test against your website or web application. Use it to understand what you should have in place — and where gaps might exist.

Each item is marked with its typical **severity impact** if missing or misconfigured.

---

Section 1: Transport Security

**✓ SSL/TLS certificate is valid and current** *Impact if missing: CRITICAL — data transmitted between users and your server is unencrypted and interceptable.*

An expired or invalid SSL certificate breaks your users' security and destroys trust. Certificates should be renewed well before expiry (30-day warning is a common threshold). Automated certificate monitoring catches this before it becomes a problem.

**✓ TLS 1.0 and TLS 1.1 are disabled** *Impact if missing: MEDIUM — older TLS versions have known weaknesses and should not be accepted.*

Only TLS 1.2 and TLS 1.3 should be accepted. TLS 1.3 is strongly preferred for new deployments.

**✓ Strong cipher suites in use** *Impact if missing: MEDIUM — weak ciphers can allow decryption of captured traffic.*

Suites like `TLS_AES_256_GCM_SHA384` are strong. RC4, DES, and 3DES are deprecated and should never be offered.

**✓ HTTP Strict Transport Security (HSTS) header present** *Impact if missing: MEDIUM — users may be downgraded to HTTP, exposing their traffic.*

HSTS tells browsers to always use HTTPS for your domain, even if a user types `http://`. Without it, attackers can intercept and downgrade connections.

---

Section 2: Security Headers

**✓ Content-Security-Policy (CSP) header present and configured** *Impact if missing: HIGH — increases XSS attack surface by allowing arbitrary script execution.*

CSP controls which scripts, styles, and resources can load on your pages. A missing or overly permissive CSP is a significant risk factor for XSS exploitation.

**✓ X-Frame-Options or CSP frame-ancestors set** *Impact if missing: LOW-MEDIUM — site may be embeddable in iframes, enabling clickjacking attacks.*

Clickjacking tricks users into clicking elements on your page without knowing it — used for fraud, account changes, and social engineering. Set `X-Frame-Options: DENY` or `Content-Security-Policy: frame-ancestors 'none'`.

**✓ X-Content-Type-Options: nosniff present** *Impact if missing: LOW — browsers may interpret files as a different MIME type, enabling certain attacks.*

**✓ Referrer-Policy header set** *Impact if missing: LOW — URLs containing sensitive path information may be leaked to third parties.*

Without this header, the full URL of pages your users visit (including query strings) may be sent to external services in the Referer header.

**✓ Permissions-Policy header present** *Impact if missing: LOW — browser features (camera, microphone, geolocation) may be accessible to third-party scripts.*

---

Section 3: Authentication and Session Management

**✓ Admin areas are protected by strong authentication** *Impact if missing: CRITICAL — unauthorised access to admin functions could compromise your entire application.*

Admin panels discovered via directory bruteforce should require strong credentials and ideally multi-factor authentication. Rate limiting on login attempts is essential.

**✓ Session cookies use HttpOnly flag** *Impact if missing: HIGH — session cookies accessible to JavaScript can be stolen via XSS.*

HttpOnly prevents JavaScript from reading cookie values, limiting the impact of XSS vulnerabilities.

**✓ Session cookies use Secure flag** *Impact if missing: MEDIUM — session cookies may be transmitted over HTTP connections.*

**✓ Session cookies use SameSite attribute** *Impact if missing: MEDIUM — increases CSRF attack surface.*

SameSite=Strict or SameSite=Lax prevents cookies from being sent in cross-site requests, significantly reducing CSRF risk.

**✓ No default credentials in use** *Impact if missing: CRITICAL — trivial unauthorised access.*

---

Section 4: Injection Vulnerabilities

**✓ Application is not vulnerable to SQL injection** *Impact if missing: CRITICAL — attacker may be able to read, modify, or delete your entire database.*

SQL injection occurs when user input is incorporated into database queries without parameterisation or sanitisation. Automated scanners test for this using a range of payloads and response analysis.

**✓ Application is not vulnerable to Cross-Site Scripting (XSS)** *Impact if missing: HIGH — attacker can execute arbitrary JavaScript in users' browsers, steal sessions, and perform actions as them.*

Both reflected XSS (via URL parameters) and stored XSS (via persisted user input) should be tested.

**✓ Application is not vulnerable to Server-Side Template Injection (SSTI)** *Impact if missing: CRITICAL — template injection can lead to remote code execution on your server.*

**✓ Application is not vulnerable to NoSQL injection** *Impact if missing: HIGH — applicable if your application uses MongoDB, Redis, or similar.*

---

Section 5: Network and Infrastructure

**✓ Only required ports are exposed to the internet** *Impact if missing: LOW-MEDIUM — unexpected open ports increase attack surface.*

Port 80 (HTTP) and 443 (HTTPS) are standard. Alternative ports like 8080 and 8443 should be verified as intentional — each exposed service is an additional attack surface.

**✓ HTTP TRACE method is disabled** *Impact if missing: LOW — can be used in cross-site tracing (XST) attacks.*

**✓ Sensitive HTTP methods (PUT, DELETE, PATCH) are restricted at the application level** *Impact if missing: LOW-MEDIUM (requires verification) — if write methods are accepted on unintended endpoints, unauthorised data modification may be possible.*

**✓ No subdomain takeover conditions exist** *Impact if missing: HIGH — attacker can serve malicious content under your domain name.*

Dangling DNS records pointing to decommissioned cloud services (AWS S3, Heroku, GitHub Pages, etc.) are exploitable for subdomain takeover.

**✓ DNS zone transfer is blocked** *Impact if missing: MEDIUM — full DNS record set exposed to any requestor, mapping your infrastructure.*

---

Section 6: Email Security

**✓ SPF record is correctly configured** *Impact if missing: MEDIUM — enables email spoofing from your domain.*

SPF specifies which mail servers are authorised to send email on behalf of your domain. Without it, anyone can send email appearing to come from you.

**✓ DMARC record is present and enforced** *Impact if missing: MEDIUM — SPF and DKIM results are not acted upon, leaving spoofed emails deliverable.*

DMARC builds on SPF and DKIM to tell receiving mail servers what to do with messages that fail authentication. A `p=reject` policy actively blocks spoofed emails.

---

Section 7: API Security

**✓ GraphQL introspection is disabled in production (or limited)** *Impact if missing: LOW (informational) — exposes full API schema to unauthenticated requests.*

If your application uses GraphQL, introspection enabled in production hands attackers a detailed map of your API. Disable it unless there's a specific reason to leave it on.

**✓ API endpoints have appropriate rate limiting** *Impact if missing: MEDIUM — enables brute force, credential stuffing, and enumeration attacks.*

**✓ CORS is correctly configured** *Impact if missing: HIGH if misconfigured — overly permissive CORS allows cross-origin requests from any domain, potentially enabling data theft.*

`Access-Control-Allow-Origin: *` on endpoints that return sensitive data is a confirmed vulnerability.

**✓ No SSRF vulnerabilities in URL parameters** *Impact if missing: HIGH — attacker can use your server to make requests to internal services.*

---

Section 8: Information Disclosure

**✓ Error messages don't reveal stack traces or internal details** *Impact if missing: LOW-MEDIUM — internal paths, framework versions, and database details help attackers fingerprint your stack.*

**✓ Sensitive data is not present in JavaScript bundles** *Impact if missing: HIGH — API keys, credentials, and secrets embedded in client-side JavaScript are publicly accessible.*

**✓ robots.txt doesn't expose sensitive paths** *Impact if missing: LOW — paths listed in robots.txt are often crawled by attackers looking for interesting endpoints.*

---

How to Use This Checklist

Running through this list manually is time-consuming and error-prone. Automated security scanning tests all of these checks — and more — against your actual site in minutes, giving you evidence-based results rather than self-assessment.

A scan will tell you which controls are passing, which are failing with evidence, what the severity is, and how to fix each finding. The output is a formal PDF Security Assessment Report you can share with your team, your developer, your insurer, or a client.

[Run a full automated security scan at yrzoai.dev →](https://yrzoai.dev)

---

*This checklist is based on OWASP testing guidelines, NCSC guidance, and common findings from automated web application security assessments. It covers external automated testing scope — some items (internal configuration, source code review, authenticated testing) require additional assessment methods.*