<p>What are the most common things to test in a new site?</p>

<p>For instance to prevent exploits by bots, malicious users, massive load, etc.?</p>

<p>And just as importantly, what tools and approaches should you use?</p>

<p>(some stress test tools are really expensive/had to use, do you write your own? etc)</p>

<p><a href="https://stackoverflow.com/questions/23102/what-are-comon-exploits-web-i-should-know-about">Common exploits that should be checked for</a>. </p>

<p>Edit: the reason for this question is partially from being in SO beta, however please refrain from SO beta discussion, SO beta got me thinking about my own site and good thing too.  This is meant to be a checklist for things that I, you, or someone else hasn't thought of before.  </p>

[{'answer_id': 23033, 'author': 'Chris', 'author_id': 2134, 'author_profile': 'https://Stackoverflow.com/users/2134', 'pm_score': 1, 'selected': False, 'text': '<ul>\n<li>What do friendly bots see (eg: Google); check using <a href="http://www.google.com/webmasters/tools/" rel="nofollow noreferrer">Google Webmaster Tools</a>;</li>\n</ul>\n'}, {'answer_id': 23055, 'author': 'EndangeredMassa', 'author_id': 106, 'author_profile': 'https://Stackoverflow.com/users/106', 'pm_score': 1, 'selected': False, 'text': '<p><a href="http://developer.yahoo.com/yslow/" rel="nofollow noreferrer">YSlow</a> can give you a quick analysis of different metrics. </p>\n'}, {'answer_id': 23220, 'author': 'Kyle Boon', 'author_id': 1486, 'author_profile': 'https://Stackoverflow.com/users/1486', 'pm_score': 3, 'selected': True, 'text': "<p>Try and break your own site before someone else does. Your web site is basically a publicly accessible API that allows access to a database and other backend systems. Test the URLs as if they were any other API.  I like to start by cataloging all URLs that have some sort of permenant affect on the state of the system - this is easy if you are doing Ruby on Rails development or trying to follow a RESTful design pattern. For each of those URLs, try running a GET, POST, PUT or DELETE HTTP methods with different parameters so that you can ensure that you're only giving access to what you want to give access to. </p>\n\n<p>This of course is in addition to obvious: Functional testing, Load Testing, SQL Injection, XSS etc.</p>\n"}, {'answer_id': 23271, 'author': 'Joshdan', 'author_id': 1990, 'author_profile': 'https://Stackoverflow.com/users/1990', 'pm_score': 2, 'selected': False, 'text': '<p>Turn off javascript and make sure your site can still be navigated.</p>\n\n<p>Even if you want to ignore the small but significant number of people who have it disabled, this will impact search engines as well.</p>\n'}, {'answer_id': 45601, 'author': 'Michael OK', 'author_id': 4637, 'author_profile': 'https://Stackoverflow.com/users/4637', 'pm_score': 1, 'selected': False, 'text': '<p>Regarding tools for running functional tests of a web pages, I\'ve found that <a href="http://selenium-ide.openqa.org/" rel="nofollow noreferrer" > Selenium IDE</a> to be useful.</p>\n\n<p>The Firefox (version 2 only compatible at the moment)   plug in lets your capture almost all web events, and save them and replay them in the same browser.</p>\n\n<p>In conjunction with another Firefox https://addons.mozilla.org/en-US/firefox/addon/1843"> Firebug\nyou can create some very powerful tests.</p>\n\n<p>If you want to set up <a href="http://selenium-rc.openqa.org/" rel="nofollow noreferrer">Selenium Remote Control</a>\nyou can then convert the Selenium IDE tests into <a href="http://www.nunit.org/index.php" rel="nofollow noreferrer"> nUnit tests</a>, which you can run automatically.</p>\n\n<p>I use <a href="http://confluence.public.thoughtworks.org/display/CCNET/Welcome+to+CruiseControl.NET" rel="nofollow noreferrer" >cruise control </a> and run these web tests as part of a daily build.</p>\n\n<p>The nice thing about using Selenium remote control is that it can run the same functional tests on multiple browsers and operating systems, something that you can\'t do with the IDE.</p>\n\n<p>Although the web tests will take ages to run, there is an version of Selenium called <a href="http://selenium-grid.openqa.org/" rel="nofollow noreferrer" >Selenium Grid</a> that lets you use any old hardware you have spare to run the tests in parallel as part of a computing grid. Not tried this myself, but it sounds interesting.</p>\n\n<p>All of the above is open source and free which helped me convince management to use if :-)</p>\n'}, {'answer_id': 76391, 'author': 'Yaba', 'author_id': 7524, 'author_profile': 'https://Stackoverflow.com/users/7524', 'pm_score': 1, 'selected': False, 'text': '<p>For checking the cross browser and cross platform look of your site, <a href="http://browsershots.org" rel="nofollow noreferrer">browershots.org</a> is maybe the best free tool that can safe a lot of time and costs.</p>\n'}, {'answer_id': 77409, 'author': 'Twan', 'author_id': 6702, 'author_profile': 'https://Stackoverflow.com/users/6702', 'pm_score': 0, 'selected': False, 'text': "<p>There's seperate stages for this one.</p>\n\n<p>Firstly there's the technical testing, where you check all technical functionality:</p>\n\n<ul>\n<li>SQL injections</li>\n<li>Cross-site Scripting (XSS)</li>\n<li>load times</li>\n<li>stress levels</li>\n</ul>\n\n<p>Then there's the phase where you have someone completely computer-illiterate sit down and ask them to find something. Not only does it show you where there's flaws in your navigational logic (I find that developers look upon things way differently than 'other people') but they're also guaranteed to find some way to break your site.</p>\n"}]
['https://Stackoverflow.com/questions/23016', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/580/']