The phrase "bells and whistles" means "things that are fancy and unnecessary".
In a website, the more fancy and automatic that a feature is,
the more useful that it tends to be for the purpose of hacking the website-users,
and the more likely that it is to be used for that purpose.
Such fancy and automatic features are often not made mandatory parts of a webpage,
in which case they constitute "bells and whistles".
Thus, the "bell-and-whistle" features of a webpage are often
the most dangerous visible parts of a webpage.
Such features include javascript-mediated features,
plugins, and some types of images.