Free checklist
Is your website actually secure?
Most small-business sites get broken into through things that are simple to fix. Here is the checklist I run through, in plain words. Work down it, or save it for later.
- 1
Keep everything updated
Out-of-date CMS core, plugins and themes are the number-one way small sites get hacked. Turn on automatic updates where you can, and check monthly.
- 2
Remove what you don't use
Every inactive plugin or theme is still code on your site. Delete the ones you don't need, don't just deactivate them.
- 3
Strong admin passwords + two-factor
A long, unique password for every admin account, plus a second step at sign-in. This alone stops most automated attacks.
- 4
Limit who has admin access
Give people the least access they need, and remove accounts for anyone who has left. Fewer admins, fewer ways in.
- 5
Real, restorable backups
Automatic backups kept somewhere other than the site itself, and test a restore once. A backup you've never restored is a guess.
- 6
Force HTTPS everywhere
A valid certificate, and every http address redirecting to https. Browsers mark anything else 'not secure'.
- 7
Protect your email domain
Set up SPF, DKIM and DMARC on the domain you send from, so your mail isn't spoofed and lands in the inbox, not spam.
- 8
Add security headers
A content security policy, HSTS and a few others tell browsers how to protect your visitors. Ask your developer, or we set them up.
- 9
Lock down the login page
Limit failed attempts, and consider hiding or protecting the admin login. It's the door attackers knock on first.
- 10
Stay on supported software
PHP and server software reach end of life and stop getting security fixes. Ask your host which version you're on.
- 11
Know within a day when a flaw lands
Serious flaws are exploited the same day they're disclosed. Follow a source that tells you what happened and what to do, fast.
- 12
Have a plan for when it goes wrong
Know who to call and how to restore before you need to. The worst time to figure it out is during an incident.
If you can tick all of these, you are ahead of most small-business websites.
Want to be told the moment a serious flaw hits software your site runs? That is what the security alerts are for.