Website security checklist for small businesses
Short answer: use HTTPS everywhere, keep software updated, keep tested off-site backups, turn on two-factor login for your site, host, domain and email accounts, add security headers, publish SPF and DMARC, protect your domain from expiry and transfer, and re-check your site regularly. Each item below links to a step-by-step fix.
Accounts and access
- Two-factor login on the website admin, hosting panel, domain registrar, email and payment provider.
- A password manager and a unique password for each account.
- Remove old staff, agency and test accounts. Give each person only the role they need.
Software
- CMS, plugins and themes updated, with auto-updates where safe. Find outdated plugins.
- Delete unused plugins, themes and old copies of the site (staging folders, backups in the web root).
- Follow the WordPress hardening checklist if you use WordPress.
Backups
- Automatic daily backups of files and database, stored off the server.
- At least one copy the website itself can’t delete (so ransomware or a hacker can’t remove it).
- Test a restore every few months. A backup you haven’t restored is a hope, not a plan.
HTTPS and headers
- Valid certificate with auto-renewal, TLS 1.2+ only, HTTP to HTTPS redirect. 6-point SSL check.
- HSTS, X-Content-Type-Options, frame protection and Referrer-Policy. Copy-paste headers.
- A Content-Security-Policy, at least on checkout pages. CSP guide.
- Secure, HttpOnly and SameSite on cookies. Cookie flags guide.
- No server, PHP or CMS version numbers on show. How to hide them.
Email and domain
- SPF, DKIM and DMARC for your domain. Records to copy.
- Domain on auto-renew, with registrar lock and two-factor login at the registrar.
- A security.txt file so people can report problems to you.
Payments
- Prefer hosted payment pages or fields from your payment provider, so card numbers never touch your server.
- Watch the scripts on your checkout. Stop checkout skimmers.
Monitoring and response
- Re-check your site after every change and at least monthly.
- Write down who to call if the site is hacked: your host, your developer, your payment provider.
- Know the signs of a hack. How to tell if WordPress is hacked.
Frequently asked questions
What is the single most important item on this list?
Keeping software updated, followed closely by two-factor login and tested backups. Most small-site hacks exploit known, already-fixed vulnerabilities or reused passwords.
Do I need a security plugin?
It can help with login protection and file monitoring, but it doesn’t replace updates, backups and two-factor login.
How long does this checklist take?
Most small sites can do the account, update and header items in an afternoon. Email records and backups may need your host or email provider.