Website security checklist for small businesses

Most website incidents start with small gaps: an old plugin, a shared admin password or a certificate that was never renewed. This checklist covers the checks that matter most for a typical small business site. Work through it once, then repeat the review every quarter and after any change to the site.

Access and accounts

• Give each person their own admin account. Remove accounts for former staff and agencies that no longer work on the site.
• Use a password manager to create long, unique passwords for every admin login.
• Turn on MFA for every admin account, including the hosting account, the domain registrar and the email account.
• Give editors the lowest role that lets them do their job. Keep the number of admins small.
• Review the list of accounts every quarter.

Software and updates

• Keep the content management system, themes, plugins and libraries up to date. Turn on automatic security updates where the platform supports them.
• Delete plugins, themes and scripts you no longer use. Each one is more code that can fail.
• Subscribe to security notices from your platform vendor so you hear about critical fixes early.

Connection and certificates

• Serve the whole site over HTTPS with a valid certificate and redirect every HTTP address to HTTPS.
• Turn on HSTS once HTTPS works everywhere, so browsers only connect over HTTPS.
• Renew certificates automatically. Set a reminder for any certificate you manage by hand.

Forms and data

• Collect only the personal data you need and say why on the form.
• Validate input on the server, not only in the browser.
• Protect forms against automated abuse with rate limits or a challenge that does not frustrate real users.
• Send form data over HTTPS and keep it only where you have a reason to keep it.

Headers and external code

• Turn on frame protection and set security headers such as Content-Security-Policy and X-Content-Type-Options. Test a policy before you enforce it, because a strict policy can break pages that work today.
• List every external script, tag and widget on the site. Remove the ones nobody uses.

Email and domain

• Publish SPF, DKIM and DMARC records so that criminals cannot easily send email that looks like it comes from your domain.
• Turn on the registrar lock for your domain and keep the registrar login protected by MFA.

Backups and recovery

• Back up the site files and the database on a schedule and store copies away from the host.
• Test a restore at least once a year. A backup you have never restored is only a guess.
• Write down who makes decisions during an incident and how to reach them outside office hours.

Monitoring and testing

• Monitor uptime and watch for unexpected changes to pages, such as new scripts or redirects.
• Ask your host for alerts on repeated failed logins.
• Run an independent vulnerability scan or penetration test on the site at least once a year and after major changes.

Where to start

Start with access and updates. They close the gaps attackers use most often and take the least time. Once the basics are in place, a scan shows which checks your site passes and which still need attention.