Website security: what to check before publishing a corporate portal

Security controls should reflect what a website actually does. An information site and a portal with user accounts expose different functions. Record the routes, collected data and external providers before defining the review.

Review how data reaches the page

Handle values according to their output context: text, attributes, URLs or data inside a script. Use framework escaping and avoid uncontrolled HTML insertion. A Content Security Policy provides another defensive layer; it does not replace safe output handling.

Test the complete contact flow

Validate fields on the server, limit payload sizes and handle failures without relying solely on browser checks. When using Turnstile, verify the token server-side and check the expected hostname and action. Pair bot checks with request limits. Test rejection paths and email provider failures as well as successful submissions.

Maintain and verify

npm audit can identify known dependency advisories. A clean result does not prove an application has no vulnerabilities. Record when checks ran and what they covered so that outstanding work remains visible.

Before release, verify HTTPS and response headers on the actual host, assign maintenance owners and rehearse restoring an earlier version. This checklist supports an initial review; a complete assessment depends on the portal’s scope.

Sources

• OWASP: XSS prevention.
• Cloudflare: server-side Turnstile validation.
• npm: dependency audits.