Website Security: A 20-Point Checklist That Protects Your Website and Your Customers

Most website attacks aren't personal. Automated bots scan millions of sites every day looking for outdated plugins, weak passwords and misconfigurations. A small business site is a target not because it's important, but because it's often unprotected. The consequences, defaced pages, spam, stolen data, Google warnings, lost rankings, can be serious.

This checklist covers 20 practical measures, from essentials every site needs to deeper protections for stores and platforms.

Essentials (every website)

1. HTTPS everywhere with a valid SSL certificate and HTTP redirected to HTTPS.
2. Keep everything updated: CMS, plugins, themes, dependencies and server software.
3. Strong, unique passwords stored in a password manager.
4. Two-factor authentication for the admin, hosting, domain registrar and email.
5. Automatic off-site backups with periodic restore tests.
6. Remove unused plugins, themes and accounts.
7. Least privilege: give each user only the access they need.

Server and configuration

1. Security headers: Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy and frame-ancestors.
2. Correct file permissions and no directory listing.
3. Hide sensitive files: .env, backups, config files and version control folders must never be publicly accessible.
4. A web application firewall (WAF) via your host or a CDN.
5. Disable unnecessary services and admin endpoints you don't use.

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"

Forms, logins and user data

1. Validate and sanitize all input on the server.
2. Rate-limit logins and forms, and use CAPTCHA or honeypots against spam.
3. Secure session cookies (HttpOnly, Secure, SameSite).
4. Never store card data; use your payment gateway's tokenization.
5. Collect only necessary personal data and protect it.

Monitoring and response

1. Uptime and security monitoring with alerts.
2. Google Search Console for security issues and malware warnings.
3. An incident plan: who to call, how to restore from backup, how to change credentials and how to inform users if needed.

WordPress-specific tips

• Limit plugins to reputable, maintained ones.
• Change the default admin username and protect the login page.
• Disable file editing from the dashboard.
• Use a security plugin or host-level firewall.
• Keep PHP on a supported version.

Static and custom sites

Static sites are naturally more secure (no database or public admin), but still need HTTPS, security headers, protected deployment credentials, dependency updates and secure forms. Custom apps should follow the OWASP Top 10.

What to do if your site is hacked

1. Take the site offline or into maintenance mode if needed.
2. Change all passwords: hosting, admin, database, FTP, email.
3. Restore a clean backup from before the compromise.
4. Update everything and remove the vulnerable component.
5. Scan for remaining malware and backdoors.
6. Request a review in Search Console if Google flagged the site.
7. Find the root cause to prevent a repeat.

Compliance basics

• A privacy policy that matches what you collect.
• Consent where required for cookies and marketing.
• Local data protection laws, such as Egypt's Law 151 of 2020 and Saudi PDPL.
• PCI DSS compliance through your payment provider for card payments.

Maintenance routines that keep security in place are in the website maintenance guide.

Security headers to set

Backups: the 3-2-1 rule

Keep 3 copies of your data, on 2 different types of storage, with 1 copy off-site. Automate daily backups of the database and weekly full backups, and test a restore at least every quarter. A backup you have never restored is a guess, not a plan.

Passwords and access

• Unique, long passwords stored in a password manager.
• Two-factor authentication on hosting, domain registrar, CMS admins and email.
• Separate accounts for each team member; remove access when people leave.
• Least privilege: editors don't need admin rights.
• Keep the domain registrar locked and its contact email secure; losing it means losing the site.

A monthly security routine (30 minutes)

1. Update CMS, plugins, themes and server packages.
2. Review admin users and remove unused accounts.
3. Check uptime and security alerts.
4. Confirm the latest backup exists and is complete.
5. Scan for malware or unexpected files.
6. Check SSL certificate expiry.

See also the Website maintenance guide.

Security for WordPress at a glance

Incident response: the first 24 hours

1. Take a snapshot of the current state for investigation, then put the site in maintenance mode if needed.
2. Change all passwords: hosting, CMS admins, database, FTP/SFTP, email.
3. Restore from the last clean backup, or clean infected files.
4. Update everything: core, plugins, themes, server packages.
5. Scan again and check for backdoors and unknown admin users.
6. Request a review in Search Console if Google flagged the site.
7. Write down what happened and what you'll change to prevent it.

Security for forms and user data

• Validate input on the server, not only in the browser.
• Use prepared statements to prevent SQL injection.
• Escape output to prevent cross-site scripting.
• Rate-limit login and contact forms.
• Store passwords only as strong hashes (bcrypt or Argon2).
• Collect only the data you need and delete it when no longer required.

Frequently asked questions

Mohamed SakrWeb & mobile app developer, SEO and digital marketing specialist. He ships complete products end-to-end — design, code, launch and growth — including apps live on Google Play and sites ranking on Google.Apps live on Google PlaySites ranking on Google50+ practical guidesMore about me →