The following checklist is used to verify whether a deployed web application adheres to best practices. These best practices cover aspects such as security, stability, speed, scalability, and automation.

Adhering to these best practices ensures that your web application is secure, stable, long-lived, compliant, highly scalable, automated for changes, and cost-effective.

Best Practices for Domain Name Procurement

file

You need to ensure that hackers cannot gain control of your domain through the domain registrar's account.

  • Is privacy protection configured for Whois information
  • Is 2FA configured for the domain registrar's account

IP Address Best Practices

Here, you need to check in your cloud provider's console whether your IP addresses comply with best practices. Ensure that both IPv6 and IPv4 are configured. You can use the firewall provided by your cloud provider to configure rules. Their firewalls are generally more robust than software firewalls you configure yourself.

file

  • Choose cloud and network providers that are geographically close to your clients.
  • Configure IPv6
  • Configure IPv4
  • Ensure that the IPv6 firewall and IPv4 firewall have the same rules configured
  • Use a static IP address

DNS Best Practices

You need to prevent hackers from taking control of your domain through DNS hijacking. At the same time, ensure that your domain has CAA records configured to restrict Certificate Authorities. Of course, you also need to ensure that your domain has AAAA records configured to support IPv6, and that it remains accessible on devices that do not support IPv6.

file

  • Configure CAA records to restrict Certificate Authorities
  • Configure DNSSEC to prevent DNS hijacking
  • Configure both A records and AAAA records

file

Cloud Computing Provider Best Practices

Although our own services handle firewall, backup, monitoring, and alerting configurations internally, cloud providers also offer these services. The services provided by cloud providers are often more robust than those we configure ourselves. Of course, don't forget to ensure the account itself is secure.

file

  • Purchased sufficient bandwidth
  • Configured 2FA for the account
  • Enabled billing circuit breakers and alerts
  • Enabled automatic renewal
  • Configured VPC for network isolation
  • Configured the cloud provider's firewall, automatic backups, monitoring, and alerting services

TLS Certificate

Obviously, you need to configure TLS encryption to protect user privacy. At the same time, you must ensure automatic certificate renewal. To prevent users from suddenly being unable to access your website, you need to redirect all HTTP requests to HTTPS.

file

TLS Best Practices

These can be checked directly through https://www.ssllabs.com/. This ensures that your TLS configuration is optimal.

file

Web Server Best Practices

The web server itself also has some best practices. These best practices ensure that your web server is efficient.

file

Don't forget that to support HTTP3, you may need to configure some rules on the firewall to ensure that UDP port 443 is open.

Best Practices for Server Network Configuration

To ensure the network security and performance of your server, you can verify here whether the server's network configuration aligns with best practices.

  • Expose only the necessary ports
  • Expose only the necessary services
  • Configure a firewall
  • Use bbr or cubic as the TCP congestion control algorithm
  • Use cake or fq_codel as the network scheduling algorithm
  • Configure NTP to synchronize time

Best Practices for Server Permission Configuration

To mitigate inherent security risks on the server, you must ensure that the server's permission configuration follows the principle of least privilege. You can enable SSH key-based authentication for public SSH access, but it is highly recommended to use an IP whitelist to restrict which IP addresses can log in via SSH.

  • Configure SSH Key access
  • Configure Fail2Ban to prevent brute-force attacks
  • Configure SELinux or AppArmor to enhance security
  • Disable SSH login for the root user
  • Disable password login and password-based login for the root user
  • Run services as a non-root user
  • Set the permissions of business folders to 700 or 750
  • Set the permissions of business files to 600 or 640
  • Ensure that business folders are owned by a non-root user and not by the nobody user
  • Configure automatic updates for package management, ensuring that commands like apt update && apt upgrade are run automatically on a regular schedule
  • Ensure that the package management repositories are secure; this requires checking files such as /etc/apt/sources.list

Best Practices for Operations and Maintenance

Even if your entire business system is already securely and stably live, you must still ensure that you can rapidly restore operations in the event of unexpected incidents, hardware failures, traffic spikes, or hacker attacks. This requires you to configure comprehensive capabilities for monitoring, alerting, snapshots, and backups. You also need to ensure that your business can be quickly migrated, scaled, and recovered.

  • Configure monitoring
    • Ensure sufficient disk space on the server. This requires monitoring disk usage and triggering alerts when disk space is low.
    • Ensure sufficient memory on the server. This requires monitoring memory usage and triggering alerts when memory is low.
    • Ensure sufficient CPU capacity on the server. This requires monitoring CPU usage and triggering alerts when CPU usage is high.
    • Monitor I/O and trigger alerts when I/O is abnormally high.
    • Monitor the IP address of each login and trigger alerts for suspicious login attempts.
    • Monitor reboot events and trigger alerts for unplanned reboots.
  • Configure alerting
  • Configure snapshots
  • Configure backups and conduct regular restoration drills.
  • Verify that your business can be quickly migrated to another server.
  • Verify that your business can be quickly Scale Up, meaning upgrading the server's configuration.
  • Verify that your business can be quickly Scale Out, meaning increasing the number of servers.
  • After Scaling Out, if multiple servers are involved, verify that consistency is maintained and that rapid recovery is possible after a single point of failure.
  • Ensure that your load balancer distributes requests evenly across different servers and routes requests from the same user to the same server.
  • Ensure that your load balancer can rapidly recover after a single point of failure.
  • Ensure that your business can be restored through rapid redeployment after a complete outage.

DevOps Best Practices

To date, your business has been running safely, stably, quickly, and scalably, meeting all expectations. However, as is well known, requirements change, and your business needs continuous iteration. This requires that your capabilities in development, testing, deployment, monitoring, and operations are all automated. You need to perform code checks on any new business changes and merge only compliant code into the codebase. You also need to regularly test and compile the code in the codebase and release compliant results to the production environment.

  • Use CI/CD to automate deployment
  • Configure static code analysis in the build pipeline
  • Configure unit testing in the build pipeline
  • Configure integration testing in the build pipeline
  • The build pipeline must be checked into the codebase itself
  • The build pipeline must regularly release compliant build results to the production environment

Containerization Best Practices

By now, your data center is already highly secure, stable, fast, scalable, and automated. However, we are in the era of containerization. If you can containerize your workloads, your business can be deployed, migrated, scaled, and recovered with greater flexibility.

file

  • Use Docker to containerize your workloads
  • Build pipelines that compile container images and perform integration testing on those images
  • Use Kubernetes to manage your containers

Application Development Best Practices

The goal of all the best practices mentioned above is to ensure that the application runs reliably. However, if the application itself is flawed, these best practices will be of no avail. The application is the core of the entire process. This is especially true for the extension components. For example, if your application is a single point of failure, business interruptions will occur even if your servers are highly available. Similarly, if the user experience is poor and the application takes 10 seconds to load on every startup, users will leave due to the bad experience, even if your servers are high-performance, all best practices are implemented, and various optimizations such as compression, caching, and acceleration are configured.

file

  • Is the development framework up to date?
  • Do the packages used contain any meaningless dependencies?
  • Are the packages used up to date?
  • Have unit tests been written, ensuring a coverage of at least 90%?
  • Have integration tests been written to ensure the application can properly perform core functions in the test environment?
  • Is a popular syntax linter used, ensuring that code not conforming to style guidelines cannot be checked in?
  • Does the code have memory leaks?
  • Does the code have deadlocks?
  • Does the code have concurrency issues?
  • Is the code vulnerable to XSS attacks?
  • Is the code vulnerable to CSRF attacks?
  • Is the code vulnerable to SQL injection attacks?
  • Is the code at risk of DDoS attacks?
  • Is the code at risk of amplification attacks?
  • Does the code have a cache stampede issue?
  • Does the code have a cache avalanche issue?

This requires repeated, periodic code reviews.

Application Experience Best Practices

Here, you need to ensure that your application provides a good user experience. These best practices include page loading speed, page interaction speed, page layout, page themes, and more.

file

  • Does the application display correctly when the user has enabled the dark theme?
  • Does the application display correctly when the user has enabled large fonts?
  • Does the application display correctly when the user has enabled image-free mode?
  • Does the application correctly display events in the local time of the event occurrence when the user is in a different time zone?
  • Does the application correctly display content in the user's language when the user has selected a different language?
  • Does the application maintain a responsive layout on mobile devices, tablets, and desktops?
  • Does the application load at an acceptable speed when the network connection is poor?

Supported Protocols

  • Does it support PWA to facilitate installation to the desktop?
  • Does it support Opensearch to search for content within the application?

Compliance Best Practices

Here, you need to ensure that your business complies with various regulatory standards. These include GPL, GDPR, CCPA, HIPAA, PCI DSS, SOX, FISMA, FIPS, NIST, and others.

  • If the code is a derivative work based on the GPL license, is the code itself licensed under GPL
  • Whether the code may engage in behavior that violates GDPR
  • Whether the code may engage in behavior that violates CCPA
  • Whether the code may engage in behavior that violates HIPAA
  • Whether the code may engage in behavior that violates PCI DSS
  • Whether the code may engage in behavior that violates SOX
  • Whether the code may engage in behavior that violates FISMA
  • Whether the code may engage in behavior that violates FIPS
  • Whether the code may engage in behavior that violates NIST standards
  • Whether the code may engage in behavior that violates China's Personal Information Protection Law, Cybersecurity Law, and Data Security Law