I'm building a web service (a control panel for clients) (PHP on linux apache) and trying from the design to make it the most secure as I can,

Can anyone provide me with some kind of a check-list of things I need to be focusing on?

I already implemented:

1. SQLi protection,
2. per session CSRF token,
3. secure password hashing storing to database with php 5.5 password\_hash(with need\_rehash check),
4. added recaptcha for all spam robots,
5. sessions manager for the user (view who logged in to my account and

close remote sessions & alert if someone accessed my account).

	6. SSL certificate, full communication over HTTPS. (i redirect all http -> https)

Questions:

1. Do I need some kind of auto ban IP system?
2. Failed login IP banning & logging?
3. Any linux-server security modifications? I did not modify anything yet
4. How do I protect my website from all spam bots/spiders? identify&ban

It will be helpful if someone can prove a guideline/checklist to all security points for a website, to go an check/secure one by one...

I think my service is secure then the most... but clearly it's not gonna change the fact that there are some skilled people chat can hack anything... - I do want to make it a bit of a challenge if someone try messing with my system... I want a website service that is more secure then others.