From a security perspective, the OWASP top 10 is required reading if you don’t know it yet. More generally, always assume your users are hostile and don’t trust

From a security perspective, the OWASP top 10 is required reading if you don’t know it yet. More generally, always assume your users are hostile and don’t trust any input that comes from them (this may come across as harsh, but really: if there is a loophole or data that you don’t validate server-side, someone will abuse it). If you need to support a variety of clients, especially older ones, stay away from fancy js stuff and focus on vanilla html and server-side rendering. Invest in a way to test your website from different clients (this can just be a few VMs running different OS/browser versions). Fun story: after launching a new SPA website, extensively tested in Chrome, FF and Safari, our first user complained of seeing a blank page. He was using IE11... Scalability is pretty much a solved problem for websites: load balancing and auto-scaling will take you a long way; you may eventually encounter a bottleneck at the database layer for which mature solutions (e.g. read replicas) exist. Invest in monitoring your app, both from a technical standpoint (response time, % of 4xx/500 pages, etc) and from a functional perspective (e.g. set up a script that simulates a login, fetching a document, filling out a form... and send an alert if the script fails)