If you're starting from zero, OWASP isn't a useless resource. If you're not going to look anywhere else for guidance, definitely read their stuff.
Having said that, OWASP's guidance is extremely... uneven. It's also consultant-focused; you can see that from the weight given to the early "fingerprint and profile the application"-type guidance, which matters a lot when you're a consultant coming in cold to an application you've never seen before, but is not a particularly good use of resources for an in-house devops/security team.
Disregard anything OWASP has to say about cryptography or password storage.
OWASP tends to have pretty reasonable coverage of "the big three" web flaws --- XSS, CSRF, and SQLI.
If you're a professional, my recommendation is to buy Daffyd Studdart's book, and Michel Zalewski's "The Tangled Web".
I have to agree. A lot of the more detailed advice is muddled, misleading or even wrong. Very little discussion and collaboration seems to be happening on the wiki - just people editing in what they think is right.
Are there any freely available resources online that cover best practices? Even StackOverflow is a quagmire when it comes to security concerns.
Edit: Or even not freely available. But preferably free :P
Having said that, OWASP's guidance is extremely... uneven. It's also consultant-focused; you can see that from the weight given to the early "fingerprint and profile the application"-type guidance, which matters a lot when you're a consultant coming in cold to an application you've never seen before, but is not a particularly good use of resources for an in-house devops/security team.
Disregard anything OWASP has to say about cryptography or password storage.
OWASP tends to have pretty reasonable coverage of "the big three" web flaws --- XSS, CSRF, and SQLI.
If you're a professional, my recommendation is to buy Daffyd Studdart's book, and Michel Zalewski's "The Tangled Web".