SecurityBangkokWeb

Web Security Basics Every Bangkok Business Should Know

9 May 2026 · by Yunmin Shin

Why Does Web Security Matter for Bangkok Businesses?

Cybercrime in Thailand is increasing. The Royal Thai Police's Technology Crime Suppression Division handles thousands of cases annually, and small and medium businesses are frequent targets because they often launch websites without any security review — usually a WordPress site with a stack of plugins nobody has audited or updated in a year.

A breach can mean stolen customer data (creating PDPA liability), a defaced website, stolen payment information, or ransomware. For a clinic, it can mean patient contact details and treatment history in an attacker's hands — a category of exposure that's both a legal problem and a trust problem the business may not recover from. The cost of fixing a breach is always higher than preventing it. These are the basics every Bangkok business website should have in place before launch.

Is HTTPS Enough?

HTTPS encrypts data in transit and is a baseline requirement — not a complete security solution. Every Bangkok business website must use HTTPS. Browsers now label HTTP sites as "Not Secure" and Google penalizes them in search rankings. Vercel, Cloudflare, and modern hosting providers issue free SSL certificates automatically, so there's no excuse to skip it.

Beyond HTTPS, set these HTTP security headers on every response:

X-Content-Type-Options: nosniff — prevents browsers from guessing content types.
X-Frame-Options: DENY — prevents your site from being embedded in an iframe (clickjacking protection).
Content-Security-Policy — controls which scripts, styles, and resources can load on your page. This is the most powerful XSS defense available, though it takes real effort to configure correctly on a page loading GA4, Facebook Pixel, LINE's SDK, and a chat widget all at once.

In Next.js, set these headers in next.config.ts under the headers() configuration so they apply globally without repeating logic per route.

What Is SQL Injection and How Do You Prevent It?

SQL injection occurs when user-supplied data is inserted directly into a SQL query string. An attacker crafts input that modifies the query itself, exposing or deleting your database. It's one of the oldest and still most prevalent web vulnerabilities — and it's entirely preventable.

Prevention is simple: always use parameterized queries or an ORM, and never concatenate user input into a SQL string. Drizzle ORM and Prisma both use parameterized queries by default, so a booking form's patientPhone field can never become part of the query structure, no matter what a malicious user types into it. If you're on Supabase, the same discipline applies to raw SQL run through the SQL editor or RPC functions — parameterize, don't concatenate.

What Is XSS and How Does React Handle It?

Cross-Site Scripting (XSS) attacks inject malicious JavaScript into your pages, which then executes in other users' browsers. React escapes HTML content by default — {userText} is safe even if userText contains <script> tags. The vulnerability appears when you use dangerouslySetInnerHTML, which is common on sites that render rich text from a CMS (a clinic's blog posts, a restaurant's promotional content). Only use it with sanitized content via a library like DOMPurify, never with raw user input.

How Do You Secure Webhooks and API Endpoints?

This is the layer most Bangkok business sites skip, because it's less visible than a login form but just as exposed. A few patterns apply to almost every project we build:

Verify LINE webhook signatures. LINE signs every webhook request with an x-line-signature header computed from your channel secret. Verify it before processing the payload — otherwise anyone who discovers your webhook URL can send fake messages or trigger bot logic as if they came from a real user.

import crypto from "crypto";

function isValidLineSignature(body: string, signature: string, channelSecret: string) {
  const hash = crypto.createHmac("SHA256", channelSecret).update(body).digest("base64");
  return hash === signature;
}

Verify payment gateway callbacks the same way. Omise and 2C2P both sign or otherwise authenticate their webhook callbacks. Never update an order's status to "paid" based on a callback's body alone without verifying it came from the gateway — and never trust a redirect from the client's browser as proof of payment, since that's trivially spoofable.

Rate-limit public forms. A clinic booking form or a contact form with no rate limiting is an open invitation for spam bots and, occasionally, deliberate abuse. Rate limit by IP at the edge (Vercel's Firewall or Cloudflare both support this) before requests even reach your application logic.

Lock down Supabase Row Level Security. If you're using Supabase, RLS policies are your actual authorization layer, not an optional extra. A missing or overly permissive RLS policy on an appointments table means any authenticated user — or, if anon access is misconfigured, any visitor — can read or write rows that aren't theirs. Test RLS policies explicitly, not just the application code that assumes they're there.

How Should You Manage API Keys and Secrets?

Never commit API keys, database passwords, or secret tokens to version control. Use environment variables and set up a .gitignore that excludes .env* files from day one. Use separate keys for development and production — an OpenAI or Claude API key used in a staging environment should never be the same key processing production traffic, so a compromised dev key doesn't touch your live system.

Rotate exposed secrets immediately. If a key is committed to a public repository, assume it's compromised within minutes — automated bots scan public repositories continuously looking for exactly this pattern.

What Is the Thailand PDPA and Why Does It Matter?

Thailand's Personal Data Protection Act (PDPA) requires businesses to obtain consent before collecting personal data, disclose how it will be used, and protect it appropriately. Violations carry fines up to 5 million baht. If your Bangkok website collects names, emails, phone numbers, or any other personal information — which describes nearly every booking form, contact form, and checkout flow — you need a privacy policy, a cookie consent mechanism, and appropriate technical safeguards around where that data is stored and who can access it.