How to ensure website security?

Most real incidents come from a short list. Authentication and authorisation being confused, so a logged-in user can reach another user's records by changing an identifier. Input trusted where it shouldn't be. Dependencies with known vulnerabilities left unpatched. Secrets committed to a repository. None of these are exotic, and all of them are found by attackers scanning automatically rather than targeting you specifically.

The one worth stating plainly: authorisation has to be enforced on the server for every request, not by hiding a button. If an endpoint returns a record to anyone who asks for its identifier, the interface hiding the link changes nothing. Secrets are the other trap — a key removed in a later commit is still in the history, so the fix is always to rotate it, not to delete it.