Website security must be incorporated into building every level of the web stack. However, I include a separate section here for topics that deserve a comprehensive review such as firewalls, SSL certificates, and public key authorization.
Authorization - specifying access rights and permissions to server and application resources. For example, a non-logged in user can view a landing page but only a logged in user can access an application's "account" screen.
How HTTPS Secures Connections: What Every Web Dev Should Know
Open Web Application Security Project (OWASP) Cheat Sheets for Security