What test points could there be for a web site?

I am a newbie tester for a web site. The backend of this site are several SQL Server databases. The UI is built with Ajax and ASP.NET. The whole site is hosted on Windows Server 2008. The site's strucuture is like this: several IIS web applications interact with a core WCF web service. This WC开发者_运维百科F web service is also a IIS web application.

Now I have got familiar with the site's workflow as a customer. It's quite simple. Just some mouse clicks on the button. But my mentor told me that there're quite a lot of test points during this "simple clicks". So what could they be?

Also, since I am totally new to this, could anyone give me advices on what aspects could I test this web site? Like function? Security? Performance? And so on. (The more detailed, the better.)

Update

It seems I am not used to thinking as a tester yet. So I would greatly appreciate any insights which could help me re-format my brain~ :)

Many many thanks.

(Also, I'd like to thank S.O. I know no other better place to post my questions.)

From a QA Perspective, what is very important are the non-Golden paths. This means, act like a customer who didn't just add an item to their cart and checkout. Do weird things. Say you want 9999 of an item, try to ship to Sarajevo (I love this city). Do whatever you can to essentially outsmart the developers. Your job is to come up with scenarios that are legit, that we(developers) didn't cover.

From the security side, familiarize yourself with Cross Site Scripting, and Cross Site request forgery. These are going to be the 2 heavy hitters that you are likely to run into. Look for scenarios where user input is being sent to the database, and make sure it is cleaned before going on it's way.