A good website security checklist for business owners covers eight areas: strong access controls, regular updates, backups you have tested, HTTPS, safe handling of forms and payments, limited permissions, monitoring, and a response plan. No checklist makes a site immune to attack, but these steps remove the most common weaknesses and limit the damage if something goes wrong.
Key takeaways
- Most website compromises come from ordinary weaknesses: weak or reused passwords, outdated software and over-generous permissions.
- Turn on multi-factor authentication for every admin, hosting and domain account.
- Keep software updated and remove plugins and tools you do not use.
- Keep backups off the web server and test that you can restore them.
- Security is ongoing work, not a one-time task, and no site can be made completely safe.
Why security is a business issue
A compromised site can leak customer data, send visitors to harmful pages, disrupt sales, damage your reputation and trigger legal or contractual obligations. Search engines and browsers may warn visitors away from a compromised site. Security is therefore a matter of protecting revenue and trust, not only a technical concern.
Be realistic: attackers range from automated bots scanning for known weaknesses to determined individuals. A good checklist makes your site a harder target and prepares you to recover, but nobody can honestly promise a site will never be breached.
1. Accounts and access
Most incidents begin with someone getting into an account they should not.
- Use a password manager and long, unique passwords for every account. Never reuse passwords.
- Turn on multi-factor authentication (MFA) for the website admin panel, hosting, domain registrar, email, code repository and payment dashboards.
- Give each person their own account. Avoid shared logins, so you can see who did what and remove one person's access without disrupting others.
- Apply least privilege. An editor does not need administrator rights. A developer rarely needs access to the payment dashboard.
- Remove access promptly when people or agencies leave a project.
- Protect your email. Whoever controls the email on your domain registrar or hosting account can often reset everything else.
2. Keep software up to date
Websites are built on layers: a content management system or framework, plugins or libraries, a server and an operating system. Known weaknesses in any layer are published and actively exploited.
- Apply security updates to your CMS, themes, plugins, libraries and server software promptly.
- Delete plugins, themes and tools you do not use, since every extra component is extra risk.
- Prefer well-maintained components with a track record of updates.
- Test updates on a staging copy first if your site is complex.
- Keep a simple list of what your site uses, so you know what needs updating.
3. Use HTTPS everywhere
HTTPS encrypts traffic between visitors and your site. Make sure every page uses it, that certificates renew automatically, and that plain HTTP redirects to HTTPS. Additional protections your developer can enable include secure cookie settings and security headers that instruct browsers to behave more safely.
4. Backups you can actually restore
Backups are your safety net against attacks, mistakes and hardware failure.
- Back up the files and the database, and any uploaded content.
- Store copies away from the web server, ideally in a separate account or location.
- Keep several versions, not only the latest.
- Protect backups with access controls and encryption, since they contain the same data as the live site.
- Test a restore at least periodically. A backup you have never restored is an assumption.
5. Forms, logins and user input
Anything visitors can type into is a potential entry point.
- Validate and sanitise input on the server, not only in the browser.
- Use well-established frameworks and libraries that guard against common issues such as SQL injection and cross-site scripting.
- Add rate limiting or bot protection on login and contact forms.
- Lock or slow down accounts after repeated failed login attempts.
- Limit file uploads to the types you need and store them where they cannot be executed.
- Show generic error messages that do not reveal how your system works.
6. Payments and personal data
- Use a reputable payment gateway that handles card details on its own secure pages, so card numbers never touch your server. This reduces your exposure considerably.
- Collect only the personal data you need, and keep it only as long as you need it.
- Restrict who can see customer records, and keep records of access.
- Publish a clear privacy notice and handle data as the laws that apply to you require. These vary by country and sector, so consult a qualified legal or compliance professional about your obligations.
- Do not store sensitive values such as passwords in readable form. A competent developer will store them using appropriate hashing.
7. Hosting, servers and configuration
- Choose hosting from a provider with a good track record and clear security practices.
- Close unused ports and services, and keep admin interfaces off the public internet where you can.
- Keep secrets, such as API keys, out of your code and public repositories.
- Use separate environments for testing and production, and never test with real customer data unprotected.
- If you run your own infrastructure, our cloud solutions and DevOps services include monitoring, backup and access practices, and our DevOps basics for small teams explains how to manage secrets and releases.
8. Monitoring and response
You cannot respond to what you cannot see.
- Turn on uptime monitoring so you know when the site is down.
- Collect and review logs for failed logins and unusual activity.
- Set alerts for changes to critical files, new admin accounts and sudden traffic spikes.
- Consider a web application firewall or content delivery network that can filter malicious traffic.
- Run periodic vulnerability scans, and for important systems consider a professional security review.
Write a simple incident plan
Decide in advance who to call, how to take the site offline if needed, how to change passwords and keys, how to restore from backup and how to inform customers if their data is affected. Keep the plan somewhere you can reach even if your systems are down.
Common mistakes
- Using one password across several services.
- Leaving old admin accounts open for former staff or agencies.
- Ignoring update notices for months.
- Keeping backups on the same server as the site.
- Assuming a small site is too unimportant to be attacked; automated bots do not choose by size.
- Installing a plugin for a minor feature without checking whether it is maintained.
- Treating security as a one-off launch task.
A short worked example
Imagine a small online store run by two people with the help of an outside developer. The owner reviews access and finds six admin accounts, two of them for people who left last year. She removes them, switches on multi-factor authentication for hosting, email and the store admin, and moves the passwords into a password manager.
The developer then removes three unused plugins, applies pending updates on a staging copy and then on the live site, and sets backups to run daily to a separate location. The team performs a test restore on a staging server. Finally, they add uptime monitoring and a short written plan listing who to call if something looks wrong. None of this makes the store untouchable, but it closes common doors and makes recovery much faster.
Building security in from the start
It is easier and cheaper to design for security than to bolt it on. When commissioning a website or e-commerce solution, ask how access is controlled, how updates are handled, where backups go and how payments are processed. For sites that connect to other systems, API security, including authentication and rate limiting, deserves its own review.
FAQ
How do I know if my website has been hacked?
Warning signs include unexpected redirects, new pages or admin users you did not create, browser or search engine warnings, sudden traffic changes, slow performance and customers reporting odd emails. If you suspect a breach, change passwords, restore from a clean backup and seek professional help.
Is an SSL certificate enough to secure my website?
No. HTTPS protects data in transit between the visitor and the site, which is important, but it does not protect against weak passwords, outdated software, vulnerable plugins or poor permissions.
How often should I update my website?
Apply security updates as soon as practical, and check regularly, for example weekly. Critical fixes deserve faster attention. Test on a staging copy first where the site is complex.
Do small business websites really get attacked?
Yes, they can. Many attacks are automated and look for known weaknesses on any site they find, regardless of size. That is why basics such as updates, strong authentication and backups matter even for small sites.
Next steps
Start with an hour of housekeeping: list who has access to your website, hosting, domain and email, remove anyone who should not, and turn on multi-factor authentication. If you would like a more thorough review of your site or help building security into a new project, you are welcome to contact us to discuss what would be most useful.
