Most of the compromised websites we clean up in Bangladesh were not targeted. They were found by a scanner, running an outdated plugin, on shared hosting, with an admin panel open to the world and a password that had been reused since 2019.
Retrofitting security costs more
A missing authorisation check caught in code review costs minutes. The same flaw found in a penetration test costs a sprint. Found by an attacker, it costs an incident response, a customer notification, and a reputation you spend years rebuilding. This is why our developers sit next to our penetration testers.
Static or dynamic — pick deliberately
A static website — pre-built HTML served from disk or a CDN — has almost no attack surface. No database, no server-side execution, nothing to inject into. For a brochure site, it is faster, cheaper to host and dramatically harder to hack.
A dynamic website or web application is the right choice when you need accounts, transactions, dashboards or content that changes constantly. It brings a real attack surface, which has to be designed for.
Choosing a heavy CMS for a five-page company site is one of the most common unnecessary risks we see. Oriole Security builds both static and dynamic sites and will tell you which one your project actually needs.
The checklist we build to
Architecture
- Threat model the flows that matter — login, payment, file upload, admin.
- Least privilege for the application's database user. A web app almost never needs DDL rights.
- Separate staging and production, with no production data in staging.
Code
- Parameterised queries with no exceptions.
- Output encoding by default in the template layer.
- Server-side authorisation on every request, checking object ownership.
- Validate uploads by type and size, store them outside the web root, and never execute them.
- Secrets in environment variables or a secrets manager, never in the repository.
Configuration
- HTTPS everywhere with HSTS; HTTP redirects permanently to HTTPS.
- Security headers: Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
- Error pages that say "something went wrong", not a stack trace with your database name.
- Directory listing off, admin paths restricted, default accounts removed.
- Automated backups, stored off the server, restore-tested.
Ongoing
- Dependency scanning in CI, with a patch SLA.
- Logging of authentication and privilege events, shipped off the host.
- A penetration test before launch and after significant changes.
Security and speed are the same work. Removing an unused JavaScript library makes the page faster and removes a dependency that could ship a vulnerability. Serving static HTML from a CDN is both the fastest and the safest option. Core Web Vitals and your attack surface improve together.
What to ask any web development agency
- Who owns security patching after launch, and is it in the contract?
- Will you hand over the source code and infrastructure credentials?
- What is your process for a reported vulnerability?
- Can the site be penetration tested before it goes live?
- How are backups taken, and have you ever restored one?
Oriole Security builds dynamic and static websites and custom web applications for businesses across Bangladesh, security-tested before they go live. Tell us about your project.