A web application security checklist is a fixed list of controls which a developer verifies before launch and after every major release. In 2026, the best basis is the OWASP Top 10:2025, where broken access control ranks first. According to OWASP, 100% of tested applications showed some form of the risk. A complete checklist covers five layers. Step 1 is server-side access control with deny by default. Step 2 is authentication, with MFA and secure session cookies. Step 3 is configuration, with HTTPS and security headers. Step 4 is dependency monitoring, because 91% of new WordPress vulnerabilities in 2025 were found in plugins, according to Patchstack. Step 5 is logging, so a breach can be reported within the 72-hour GDPR deadline. For example, a customer portal for 200 customers built with Next.js and PostgreSQL needs all five layers.
What is a web application security checklist?
A web application security checklist is a practical list of controls which every release of a web app must pass. The list turns abstract risk into concrete yes-or-no checks, such as whether every API route verifies the user role on the server. The OWASP Top 10:2025 is the best foundation for such a list in 2026. Contributors donated data on more than 2.8 million applications for the 2025 edition, according to OWASP. A checklist matters most for small and medium-sized businesses, because one leaked customer table can trigger a GDPR notification, lost trust and an expensive rebuild. In practice, the checklist below fits any modern stack, for example a customer portal for 500 users built with Next.js, Node.js and PostgreSQL. First, the article covers the OWASP risks. Second, the article lists concrete checks per layer. Finally, the article explains what European law expects after a breach.
What changed in the OWASP Top 10:2025?
The OWASP Top 10:2025 is the 2025 ranking of the ten most critical web application security risks, published by the OWASP Foundation. Broken access control remains number one, and server-side request forgery (SSRF) is now part of the same category. In the 2025 data, 100% of the applications tested showed some form of broken access control, according to OWASP. Security misconfiguration moved up from fifth place in 2021 to second place in 2025. Two categories are new: Software Supply Chain Failures and Mishandling of Exceptional Conditions. OWASP built eight of the ten categories from contributed data and selected the other two through a community survey. In practice, the lesson for a business owner is simple. Most breaches start with ordinary mistakes in permissions, settings and third-party packages, not with exotic attacks. The table below translates each 2025 category into a concrete check, for example for a web app built with Next.js.
How do you secure access control and authentication?
Access control is the set of server-side rules which decides what each user may see and change. The core principle, according to OWASP, is deny by default for everything except public resources. OWASP links 40 known weaknesses to the category and counted 1,839,701 occurrences in the 2025 data. The check must run in trusted server code, because a hidden button in the browser stops nobody. Every query should also enforce record ownership, so customer A can never load an invoice of customer B by changing an ID in the URL. Authentication is step 2 of the checklist. The Dutch Data Protection Authority (AP) defines multi-factor authentication as a combination of at least 2 different types of authentication factors. For example, a password plus a code from Google Authenticator or Microsoft Authenticator meets the definition. Additionally, limit login attempts per IP address and per account. Finally, store sessions in cookies with Secure, HttpOnly and SameSite flags.
Which configuration settings and HTTP headers should you check?
Security misconfiguration means an application runs with unsafe defaults, open storage or missing protections, even when the code itself is sound. In the 2025 data, 100% of the applications tested had some form of misconfiguration, according to OWASP. The category rose from place 5 to place 2. First, serve every page over HTTPS and add an HSTS header, so browsers never fall back to plain HTTP. Second, set a Content-Security-Policy, which limits where scripts may load from and blunts cross-site scripting. Third, add X-Content-Type-Options, a Referrer-Policy and frame-ancestors protection against clickjacking. OWASP also advises keeping secrets out of code and pipelines, with short-lived credentials or role-based access instead. In practice, with Next.js a developer defines all headers in one configuration file. Verify the result after every deploy with a scanner, because a hosting change can silently remove a header.
How do you protect dependencies, input and error handling?
A software supply chain failure is a compromise in the packages, build tools or distribution channels an application depends on. OWASP added the category in 2025, and exactly 50% of survey respondents ranked the risk as number one. The npm worm Shai-Hulud reached more than 500 package versions in 2025, according to OWASP. Step 1 is a committed lockfile. Step 2 is a software bill of materials (SBOM). Step 3 is automated alerts through Dependabot or Renovate. Injection is the next risk. Never build SQL by gluing strings together, and use parameterised queries through the database driver or an ORM such as Prisma. Validate every input on the server with a schema, for example with Zod. Finally, the new category Mishandling of Exceptional Conditions covers code which fails open. A crashed permission check must block the request, and users should see a neutral error message without stack traces.
What does the GDPR require when a data breach happens?
The GDPR requires the controller to report a personal data breach within 72 hours after becoming aware of the breach. The only exception is a breach where a risk to the people involved is unlikely. Becoming aware means being reasonably certain a security incident affected personal data. In the Netherlands, the notification goes to the Dutch Data Protection Authority (AP) through an online form. A complex incident such as ransomware still needs a first, preliminary notification within 72 hours, according to AP guidance. Weekends, holidays or illness do not count as valid reasons for a late notification. In Germany, the commissioner BfDI warns of fines up to 10 million euros or 2% of worldwide annual turnover for violations of the reporting duties. Fast reporting requires good logging. OWASP lists Security Logging and Alerting Failures as A09:2025. For example, log logins, permission errors and data exports, and keep personal data out of logs. Send alerts through Slack or email to a person who responds.
Frequently asked questions
How often should you check the security of a web application?
A security check is a recurring review, not a one-off task before launch. A sensible rhythm in 2026 has three layers. First, automated dependency alerts run continuously, because new vulnerabilities appear every week. Second, the full checklist runs before every major release, for example when a new user role, payment flow or API integration goes live. Third, a deeper review or an external penetration test follows at least once a year for applications with personal or financial data. Configurations need automated verification in every environment, according to OWASP. Small web apps built with Next.js or WordPress also need monthly updates of the framework and plugins. Patchstack counted 11,334 new WordPress vulnerabilities in 2025. Moreover, 46% of the vulnerabilities received no fix in time for public disclosure (Patchstack 2026). Planning the work into a maintenance agreement prevents the classic situation where nobody feels responsible after launch.
Is HTTPS enough to secure a web application?
HTTPS is necessary but covers only one layer of web application security. HTTPS encrypts traffic between the browser and the server, which protects passwords and personal data against interception on public Wi-Fi. HTTPS does nothing against broken access control, the number one risk in the OWASP Top 10:2025. An attacker with a valid account can still request the data of another customer over a perfectly encrypted connection. HTTPS also offers no protection against injection, vulnerable npm packages or weak passwords. Broken access control appeared in 100% of the applications tested for the 2025 edition, according to OWASP. Treat the padlock icon as the first item on the checklist, not the last. Then add server-side permission checks, MFA, security headers, dependency monitoring and logging, as described above. In practice, hosting with Vercel or Netlify gives a Next.js app HTTPS by default, yet every other check remains necessary.
Who is responsible for security when you outsource development?
The client is the party responsible for security under the GDPR, because the organisation which owns the application and the personal data remains the controller. Step 1 is to check the roles. When the agency also hosts or maintains the application with access to personal data, the agency can act as a processor. Controller and processor must then have a processing agreement in place, according to Article 28 of the GDPR. Step 2 is to name concrete measures in the agreement, for example MFA for admin accounts, encrypted backups and a response time for security incidents. Step 3 is an OWASP Top 10:2025 walkthrough before launch, because broken access control appeared in 100% of applications tested by OWASP. VirtuoLab works with a fixed price upfront and direct contact with the developer who builds the application. Finally, the client owns the source code and the data after delivery, which keeps an independent audit possible at any time.