Nobody writes good code always, and a code reviewing system allows high-quality output from developers. It also allows more than one developer to get familiar with the code so if the author of the code is not available, the other developer can make alterations easily. GitHub and Team Foundation are some of the products providing code reviewing.

Every application needs permissions and roles. Application admins, user organization admins, and for other roles a global flexible roles system should be there.

All the errors should be logged for future inspections globally. That is, no error should be able to pass the global error logger.

Apply as much as you can from: Unit tests, End to End tests, Integration tests, Component interface tests, System tests, Acceptance tests...

Before every deployment a testing server should run all the tests and deploy the application if the code-base passes all the tests, and should report to administrators otherwise.

One of the most time consuming problems during development is having different development environments between developers. Let people know what should they install, which version, with which components and how.

The code in business layer must be generic and even if it's targeted for web environments, it should work in a desktop, server or mobile environment with a different user interface and data layer without any requirement of code change.

A well-defined coding standard play a big role for the future of the project. Does every method needs a comment? What are the naming conventions? Where should the sample code usages go?

NoSQL databases (document databases) are very fast when it comes to receive and store data. They also scale better. Although they don't have relational integrity and it is better to use relational databases for critical data, using NoSQL saves costs and can definitely be safely used in places like notifications, chat messages etc.

The datacenter location should be close to most of the users. A datacenter in the same country makes huge impact in page speeds. Use multiple datacenters if necessary.

When stored data increases, the application loses performance. Application architecture should be ready for working with multiple data sources for scaled data from different sources.

XSS is short for Cross Site Scripting web vulnerability which let's user execute a malicious URL.

SQL Injection is a common vulnerability where SQL commands are manipulated as strings by the attacker and allows harmful SQL commands to be executed. Using an ORM is a good way to be protected.

Cross-Site Request Forgery is a common web vulnerability which allows attackers to place an iframe in their websites and requests pages from the application while user is not in the application. Not making any modification with GET requests is mandatory, and protecting POST requests outside of application's domain also has protection but providing a token in each form and validating against it the best solution.

Even if user is remembered in that computer, or even if user successfully logged in some time ago the password should be always asked when accessing or modifying critical data like password itself, email address, or getting backup of the data.

When serving pages in HTTPS, serve only in HTTPS. Otherwise a middle-man can act as a HTTPS-HTTP transformer and interprets the data by letting the user make requests in HTTP.

HTTPS is a world-standard encryption and there's no overhead except after the initial connection hand-shake. All the pages and resources should be transferred over HTTPS. Using HTTPS also reveals referral information when the source is also HTTPS, otherwise browsers don't provide it for security reasons.

Session cookies can be hijacked . Browser headers and user's last IP address location can be validated against original session's. An aggressive protection is matching sessions against IP addresses, but this is problematic on dynamic IP addresses and on mobile devices.

All of the codes in Business and Data layers should be covered with tests. Mixing up user's data or calculating wrong results and serving or storing them means losing users and losing money.

There are 3rd party services for monitoring online time of the servers. Also a custom service can be implemented for checking the status of the servers in specified time intervals.

Verbose error pages output any information related to the error, which every developer needs. In the production environment that should be turned off while the application is still able to continue logging the problems.

When there's an error, or a request like password-entry happens users should land where they want to go or where they came. Always take user either where they came from, or where they want to go.

The common way of designing UIs is designing for the desktops first and then adapting it to mobile devices. Although this works, it gives the overhead on mobile devices. The UI must be designed for mobile, and adapted for desktops.

There are always cases when developers and testers cannot forecast the issues. The best way is to get user feedback with a global mechanism which can be accessed every page.

Users may be using a Windows, Mac, Linux, Mobile device or a device not commonly known and the UI must behave same in every environment. Best way to achieve that is confirming the standards and not using non-standard components. Also design frameworks like Bootstrap or Foundation helps.

Although a web application is generally not focused on organic visitors (from search engines) when people share URLs in emails or in IMs the shared person would want to know what will be opened after clicking that link. People tend to explain less, so the URLS they share should at least explain what is that URL related to.

Even if you have only 1 client, or thousands, when they buy your product always over-deliver. Providing more than expected will cover defects which every software product has.

Chances are low that visitors or even your paying users will share your app on the social networks. There should be incentives to get shared, like offering discounts. This requires using Facebook, Twitter and other social network APIs to distribute offerings.

Keeping users up to date is important. When people use a product, they like knowing if you are continuously supporting the product and making it better. Creating a mailing list and letting users know about new improvements monthly shows responsibility.

Don't expect for users to come to you, you have to work for it. Although there are great premium advertising solutions, it is possible to market your app on the internet without paying a dime by offering value for free or cheap. Then you can refer your actual product.

It is very important to understand why a user lefts your service. An example system may email gone users after they leave, offer value (discounts etc.), and ask for their feedback.