Yes use Haskell and the type safety provide a safe by default environment.
More than that a lot of thought was given in all aspect of a modern web application.
So there are a lot of optimisations made for you for free. Pre-compiled templates, smart routing, the assets are saved with their hash as name so caching them is optimised.
Also OpenId login is integrated, protection of your resource is also centralised. Review collected by and hosted on G2.com.
There are very few things I dislike about Yesod. Maybe the recompilation time by `yesod-devel` is not the best, but you could work around this problem by using ghci or maybe `wai-devel` directly.
The framework wasn't though to be API only. In that sense it might feel a bit old fashioned. But I use it mainly to code REST API. Review collected by and hosted on G2.com.