Do you want to become a developer in 2025?
Are you learning on your own through free tutorials, perhaps while changing careers?
Perfect. This world is waiting for you with open arms.
But be careful: learning independently is great… but it can also lead you to develop bad habits.
And those habits can slow your progress, damage your confidence, or worse: compromise your website’s security.
So today, we are cleaning things up. Together.
Here are 10 of the most common mistakes in web development — and most importantly, how to stop making them.
1. You Do Not Validate User Input? Watch Out!
“What if someone entered malicious code into my form?”
— You, two minutes from now.
Imagine this: you create a contact form. Simple. A “name” field and an “email” field.
You think: “It is harmless.”
But what if someone pastes this into it:
<script>alert('Hacked!')</script>
…and your website displays it without checking anything? Boom. You have just been attacked.
This is called XSS — Cross-Site Scripting. And it happens more often than people think.
✅ What Should You Do?
- In the browser: use tools such as
Validator.js to check that an email looks like a valid email address. - On the server: never trust user input. Ever.
- Use prepared or parameterized queries to protect against SQL injection.
- Sanitize HTML when your application intentionally accepts HTML content. Libraries such as
sanitize-html can help filter dangerous markup.
💡 Human tip:
“If someone gives you an apple, you wash it. If someone gives you data, you validate it.”
2. Is Your Website Slow? People Leave
“My website loads in eight seconds… that is not a big deal, right?”
— You, before realizing that users do not like waiting.
A slow website is a serious problem.
Even if your design is beautiful. Even if your content is excellent.
And sometimes, the problem comes from a single uncompressed 5 MB PNG image.
✅ What Should You Do?
- Compress your images: use TinyPNG or ImageOptim.
- Use modern image formats such as WebP when appropriate.
- Load non-critical images on demand with
lazy loading:
- <img src="photo.webp" loading="lazy" alt="Mountain landscape">
- Audit your website regularly with Google Lighthouse to identify performance problems.
🚀 Small bonus: Better performance can also support SEO. Two birds with one stone.
3. Are You Ignoring Mobile? You Are Losing Visitors
“My website looks great on my 27-inch monitor.”
— You, before testing it on your phone.
A large portion of web traffic comes from mobile devices.
If your website does not adapt properly, you can lose part of your audience.
Example: a navigation bar fixed at 1200px? On a phone, it overflows and becomes difficult or impossible to use.
✅ What Should You Do?
- Responsive CSS: use
@media queries: - @media (max-width: 768px) {
- .menu { flex-direction: column; }
- }
- Frameworks such as Bootstrap or Tailwind CSS can help you build responsive layouts.
- Test, test, test: use Chrome DevTools and its device toolbar.
📱 Tip:
“If your website does not work on mobile, it does not fully work.”
4. Coding Without Testing? You Are Building on Sand
“It works on my computer.”
— One of the most dangerous sentences in development.
Imagine your shopping cart allows someone to add a product priced at -€50.
You did not test it? Surprise: someone exploits it, and you lose money.
Testing is not only for experts. It helps prevent serious regressions and mistakes.
✅ What Should You Do?
- Unit tests: verify individual pieces of logic. Example with Jest:
- test('the cart calculates the total correctly', () => {
- expect(calculateTotal([10, 20])).toBe(30);
- });
- Automate testing: with GitHub Actions, your tests can run whenever your code changes.
- Start small: test one function at a time.
🧠 Metaphor:
“Writing code without tests is like driving without a seat belt. You might be fine… until something suddenly goes wrong.”
5. Do You Only Say “Error”? Your User Hates That
“An error occurred.”
— One of the most frustrating messages on the web.
And as a user, what do you think when you see that?
“Thanks, I had not noticed.”
A good error message is a guide, not a slammed door.
✅ What Should You Do?
- Be clear:
- → Bad: “Error”
- → Better: “Invalid email. Example: name@site.com”
- Log useful technical information: tools such as
Winston for Node.js or Monolog for PHP can help. - Handle errors appropriately with mechanisms such as
try/catch: - try {
- await connectToDatabase();
- } catch (err) {
- logger.error("Connection failed", err);
- }
💬 Imaginary conversation:
User: “Why isn’t this working?”
You, with logs: “Ah, the database is down. Now I know where to investigate.”
6. Are You Storing Passwords in Plain Text? Seriously?
“I just store them in the database like this: password123.”
— You, before learning about password hashing.
If your database is compromised, plain-text passwords become immediately visible.
And many people reuse passwords across multiple services.
✅ What Should You Do?
- Use HTTPS to protect communications in transit.
- Use a strong password hashing algorithm such as
bcrypt or Argon2. Example: - const hash = await bcrypt.hash('password', 10);
- For cookie-based sessions, use appropriate cookie protections such as
HttpOnly and Secure.
🔐 Golden rule:
“If your application can read a user’s original password from storage, something is wrong.”
7. Is Your Code a Mess? Nobody Will Be Able to Help You
“Everything is inside src/. That makes sense, right?”
— You, before reaching 50 files.
A well-organized project is easier to maintain.
A disorganized project becomes harder to understand and evolve.
✅ What Should You Do?
- Use a clear structure:
- /src
- /components
- /pages
- /utils
- /styles
- Use consistent naming conventions such as
camelCase or methodologies such as BEM where they fit your project. - Document the project: even a small
README.md can save a lot of time.
🗂️ Tip:
“Organize your code so that another developer can understand the project without unnecessary detective work.”
8. Are You Ignoring Accessibility? You Are Excluding People
“My website looks beautiful.”
— You, before thinking about users with disabilities.
An informative image without useful alt text may be inaccessible to someone using a screen reader.
A control that only works with a mouse may be inaccessible to someone who relies on a keyboard or another input method.
✅ What Should You Do?
- Use semantic elements:
<button> instead of a generic clickable <div onclick> when the element is actually a button. - ARIA: use accessible names such as
aria-label="Close" when an icon-only control needs one. - Contrast: use WebAIM Contrast Checker.
- Test with assistive technologies such as NVDA or VoiceOver.
❤️ Strong message:
“An inclusive website is a human website.”
9. Are You Using Outdated Dependencies? You May Be Creating Security Risks
“I installed this library in 2020. It still works!”
— You, before npm audit starts complaining.
Dependencies can contain vulnerabilities, especially when they are outdated or no longer maintained.
And one vulnerable dependency may be enough to expose part of your application.
✅ What Should You Do?
npm audit: run dependency security checks regularly when using npm.- Dependabot: enable automated dependency alerts and update pull requests on GitHub when appropriate.
- Prefer well-maintained libraries with a trustworthy development and security history.
🛡️ Simple rule:
“A dependency is like a guest in your home. Know who you are letting in.”
10. Are You Ignoring SEO? Your Website May Be Difficult to Find
“My website is ready. Now I’ll wait for visitors.”
— You, before realizing that search engines need clear signals about your content.
Poor page structure, weak metadata, crawlability problems, or an incomplete sitemap can make discovery and indexing harder.
✅ What Should You Do?
- Use semantic HTML:
- <h1>Main title</h1>
- <meta name="description" content="Learn web development without the common mistakes">
- Maintain a useful sitemap.xml for indexable URLs.
- Use Google Search Console to inspect indexing and search performance.
🔎 SEO tip:
“Search engines benefit from websites that are clear, fast, useful, and technically accessible — just like users do.”
Ahmed Oumezzine
