Small Business Website Security Checklist: 15 Checks You Can Do This Month

1–3. Lock down every account

Turn on multi-factor authentication for your hosting account, domain registrar, CMS admin, business email and code repository. These are the keys to the business; a stolen password on any of them can take the whole site down or redirect your domain.

Use a password manager so every account has a unique, long password. Then review users: remove former staff, agencies and freelancers, and give remaining users only the permissions they need. An editor doesn’t need administrator rights.

4–6. Keep everything updated

Outdated plugins, themes and frameworks are the most common way websites are compromised. Update the CMS core, plugins and themes regularly, and remove anything unused; deactivated plugins can still be exploited if their files remain.

For custom-built sites, keep framework and package dependencies patched, and watch for security advisories. Don’t forget the server: operating system, PHP, Node.js and database versions all reach end of life and stop receiving security fixes.

7–8. Back up and test the restore

Take automatic daily backups of files and databases, store them off-site (not only on the same server) and keep several days or weeks of history, so you can go back to before a problem started.

A backup you have never restored is a hope, not a plan. Test a restore to a staging environment at least every few months and write down the steps.

9–10. Harden the admin area and hosting

Limit login attempts, use a non-obvious admin username, and if possible restrict admin access by IP address or put it behind single sign-on. Disable file editing from inside the CMS dashboard. Turn off directory listing, protect configuration files and make sure error messages don’t reveal software versions or file paths.

At the hosting level, use SFTP or SSH keys instead of FTP, keep file permissions tight, and use a web application firewall or a CDN with security features to filter malicious traffic.

11–12. Secure forms and data

Every contact, quote and login form is an entry point. Validate input on the server, add spam protection, and never ask for sensitive data such as card numbers or ID documents through ordinary forms or plain email. Collect only the data you need, and make sure your privacy policy says what you collect and why.

For custom applications, review the OWASP Top 10: injection, broken access control and security misconfiguration remain among the most common and serious web risks.

13–14. Enforce HTTPS and set security headers

Serve every page over HTTPS with certificates that renew automatically, and redirect HTTP to HTTPS. Add security headers such as HTTP Strict Transport Security, a content security policy suited to your site, X-Content-Type-Options and a sensible referrer policy. These reduce the impact of several common attacks.

15. Monitor, and have a plan for a bad day

Set up uptime monitoring, malware scanning and alerts for unexpected file changes or new admin users. Write a one-page incident plan: who to call, where backups are, how to take the site offline, how to change all passwords and how to tell customers if their data was affected.

If you are hacked, don’t just delete the visible malware. Restore from a clean backup, patch the hole that let the attacker in, rotate every credential, and check Google Search Console for security warnings.