Web application security involves implementing protective measures against potential threats, malicious or unintentional, that exploit exposed vulnerabilities. Security is best implemented using the defence-in-depth technique by applying protective measures at network, host, and web application levels.