Web security

Web sites are unfortunately prone to security risks. And so are any networks to which web servers are connected. Web servers by design open a window between a network and the world. The care taken with server maintenance, web application updates and a web site coding will define the size of that window, limit the kind of information that can pass through it and thus establish the degree of web security.
"Web security" is relative and has two components, one internal and one public. Relative security is high if it has few network resources of financial value, the company and site aren't controversial in any way, the network is set up with tight permissions, web server is patched up to date with all settings done correctly, applications on the web server are all patched and updated, and web site code is done to high standards.
Web security is relatively lower if the related company has financial assets like credit card or identity information, if web site content is controversial; servers, applications and site code are complex or old and are maintained by an underfunded or outsourced IT department.
Web site undoubtedly provides some means of communication with its visitors. In every place that interaction is possible that have a potential web security vulnerability. Web sites often invite visitors to:

• Load a new page containing dynamic content • Search for a product or location • Fill out a contact form • Search the site content • Use a shopping cart • Create an account • Logon to an account

In each case noted above respective web site visitor is effectively sending a command to or through respective web server - very likely to a database. In each opportunity to communicate, such as a form field, search field or blog, correctly written code will allow only a very narrow range of commands or information