Guidelines on Securing Public Web Servers

Completed 

Action 

SSIs are disabled or execute function is disabled 

All user input is validated 

Dynamically created pages do not create dangerous metacharacters 

Character set encoding should be explicitly set in each page 

User data should be scanned for byte sequences that mean special 

characters for the given encoding scheme 

Cookies should be examined for any special characters 

Encryption mechanism is used to encrypt passwords entered through 

scripts forms 

For Web applications that are restricted by username and password, 

none of the Web pages in the application should be accessible 

without going through the appropriate login process 

All sample scripts are removed 

No third party scripts or executable code are used without verifying 

the source code 

51