How to check website security?

Question

Information Security

We are developing a site with an exchange from 1C.
The question is how to check the security of the site for hacking or data leakage?

At the moment, I approached this issue in the following way.
All services are divided into containers, user authorization is not on the cms side, the exchange is closed by double authorization with filtering by ip address, passwords for users from 8 characters of different case and special characters, filtering input data on forms, data typing in the exchange using ORM to work in the database .
Additionally, the code is scanned by SonarQube and at the beta stage, scanning will be carried out through OwaspZap.

What additional can be used to minimize the possibility of data merging?

Answer 1

Order a comprehensive security audit.

Answer 2

Install WAF, there are also free ones

Answer 3

https://qna.habr.com/q/933705#answer_1870361

Answer 4

There are a lot of vulnerability scanners