As are result of security penetration test the following changes applied:

All authentication related cookies tagged as httpOnly
web.config: enabledVersionHeader=false
autocomplete disabled
Login url injection redirection fixed
session hijacking implemented

Dont forget to apply ssl to your website with https and to set the requireSSL="false" to true

WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/Code/Framework/PanelSecurity.cs

@@ -130,6 +130,7 @@ namespace WebsitePanel.Portal
             HttpContext.Current.Items[key] = s;
 
             HttpCookie cookie = new HttpCookie(key, s);
+            cookie.HttpOnly = true;
             HttpContext.Current.Response.Cookies.Remove(key);
             HttpContext.Current.Response.Cookies.Add(cookie);
         }