Roadmaps library Foundations for security Build and run systems

Web development

Build websites and web apps, from the page people see to the server and database behind it.

Time: 28–38 weeks

Browse all roadmaps

Foundations for security

Cybersecurity & AI security roadmaps55

Core domains6
Infrastructure5
Data protection4
Engineering and product5
Defensive security6
Offensive security7
GRC and audit7
AI security7
Specialised and emerging8

Certifications8

Time
28–38 weeks
Leads to
Front-end developer, Back-end developer, Full-stack developer

People who want to build things others can use right away, in a browser.

  1. Stage 1: HTML, CSS and how the web works , 4–6 weeks

    What to learn

    • Semantic HTML
    • Accessibility
    • CSS layout with flexbox and grid
    • Responsive design
    • Browser developer tools

    Free resources

    Build: A personal page that works on a phone and passes an accessibility check.

    Move on when: You can rebuild the layout of a site you like from scratch.

  2. Stage 2: JavaScript in depth , 6–8 weeks

    What to learn

    • The DOM and events
    • Functions, closures and objects
    • Promises and async/await
    • Fetching data from APIs
    • Modules

    Free resources

    Build: An app that uses a public API, such as a weather or book search app.

    Move on when: You can build an interactive page without a framework.

  3. Stage 3: A front-end framework and TypeScript , 6–8 weeks

    What to learn

    • Components and state
    • Forms and validation
    • Routing
    • TypeScript types
    • Testing components

    Free resources

    Build: A multi-page app with forms, saved state and at least a few tests.

    Move on when: You can explain when a component re-renders and why.

  4. Stage 4: Back end and databases , 8–10 weeks

    What to learn

    • HTTP in detail
    • Building REST APIs
    • Login, sessions and tokens
    • PostgreSQL
    • Automated tests

    Free resources

    Build: An API with user accounts and a database, with tests, used by your front end.

    Move on when: You can design an API, store data safely, and test it.

  5. Stage 5: Ship it, safely , 4–6 weeks

    What to learn

    • Deploying an app
    • Environment variables and secrets
    • HTTPS
    • Continuous integration
    • The OWASP Top 10

    Free resources

    Build: Deploy your full app with automatic tests on every push, and check it against the OWASP Top 10.

    Move on when: Strangers can use your app and you would know if it broke.

Back to all paths

Last reviewed: . Found a broken link, or want a path added? Contact