Protect Your Website with the Least Privilege Principle