Website security must be thought about while building every level of the web stack. However, this section includes topics that deserve particular treatment, such as cross-site scripting (XSS), SQL injection, cross-site request forgery and usage of public-private keypairs.

Security monkey monitors for changes to AWS, Google Cloud, GitHub and other infrastructure systems.

HTTP Evader is an automated testing tool for checking firewalls to ensure they are protecting the appropriate ports and payloads.

TLS Observatory provides a suite of security tools for analyzing and inspecting Transport Layer Security (TLS) services. There is also a hosted version you can use at observatory.mozilla.org .

Charles is an HTTP proxy for inspecting headers, requests and responses for all traffic that flows through it.

lynis ( source code ) is a security audit tool that can run as a shell script on a Linux system to find out its vulnerabilities so that you can fix them instead of allowing them to be exploited by malicious actors.

Heartbleed is a vulnerability in OpenSSL implementations that must be patched for any systems you run otherwise you are at serious risk for data leakage.

httpoxy is a set of vulnerabilities that can affect Python web application servers via HTTP requests.

SSL over HTTP (HTTPS) is mandatory for securing web data traffic in transit. There is a page dedicated to HTTPS and the following resources can also give you a good overview of how HTTPS works.

Qualy SSL Server Test can be used to determine what's in place and what is missing for your server's HTTPS connection. Once you run the test read this article on Getting an A+ on Qualy's SSL Labs Tester to improve your situation.

The first few milliseconds of an HTTPS connection provides a detailed look at the SSL handshake process that is implemented by browsers based on the RFC 2818 specification.

How HTTPS Secures Connections is a guide for what HTTPS does and does not secure against.

The Sorry State of SSL details the history and evolution of SSL/TLS. There are important differences between the versions and Hynek explains why TLS should always be used. The talk prompted work to improve Python's SSL in 2.7.9 based on the upgrades in Python 3 outlined in The not-so-sorry state of SSL in Python .

If you're having users submit sensitive information to your site you need to use SSL/TLS. Anything before TLS is now insecure. Check out this handy guide that goes over some of the nuances of the subject.

If you have wondered what all the SSL/TLS acronyms and settings mean, read the Security/Server Side TLS guide which Mozilla uses to operationalize its servers.

This question asking what is the difference between TLS and SSL? explains that TLS is a newer version of SSL and should be used because SSL through version 3.0 is insecure.

These introduction to HTTPS videos explain what HTTPS is and how to implement it.

How does HTTPS actually work? is a well-written overview of the protocol including certificates, signatures, signing and related topics.

The Open Web Application Security Project (OWASP) has cheat sheets for security topics.

Stanford's CS253 class is available for free online, including lecture slides, videos and course materials to learn about web browser internals, session attacks, fingerprinting, HTTPS and many other fundamental topics.

The SaaS CTO Security Checklist is an awesome list of steps for securing your infrastructure and employees as well as what stage and size company it is recommended that you put those procedures in place.

Reckon you've seen some stupid security things? Here, hold my beer... provides hilarious, and terribly sad, security vulnerabilities and weaknesses around encryption and password storage.

This page contains a fantastic curated list of security reading material from beginning to advanced topics.

How to protect your infrastructure against the basic attacker presents a good overview of what you need to think about when hardening your system against reasonablely competent malicious attackers.

The /r/netsec subreddit is one place to go to learn more about network and application security.

Hacking Tools Repository is a great list of password cracking, scanning, sniffing and other security penetration testing tools.

The EFF has a well written overview on what makes a good security audit. It's broad but contains some of their behind the scenes thinking on important considerations with security audits.

Ubuntu system hardening guide provides step-by-step instructions for hardening the most recent three Ubuntu LTS releases.

Crypto 101 is an introductory course on cryptography for programmers.

The first answer to the question "Why are salted hashes more secure for password storage?" on Stack Overflow gives a wonderful explanation for why this is an important technique to use to keep your database passwords and other secrets more secure if the hashed strings are leaked.

An in-depth analysis of SSH attacks on Amazon EC2 shows how important it is to secure your web servers, especially when they are hosted in IP address ranges that are commonly scanned by malicious actors.

Cloud Security Auditing: Challenges and Emerging Approaches is a high-level overview of some of security auditing problems that come with cloud deployments.

Wondering how the common buffer overflow attack works? Check out this article on buffer overflows that explains the attack in layman's terms.

7 Security Measures to Protect Your Servers provides a good overview of the fundamentals for how servers should be configured for baseline security.

As you're developing on Linux, you'll want to read and follow this Linux workstation security document to make sure your code and environment are not compromised. If you're on Mac OS X, check out this securing Yosemite guide which covers that environment.

Timing attacks are one form of vulnerability that can be used to defeat HTTPS in certain configurations. Understanding how those attacks work is important in keeping your users' connections secure.