Small-business websites collect enquiries, customer details, login credentials and sometimes payments. Even a simple brochure site can be abused to distribute spam, redirect visitors, impersonate a brand or attack other systems. The impact can include downtime, lost leads, recovery costs and damaged customer trust.
This website security checklist is written for business owners, marketers and website managers—not only developers. It prioritises actions that reduce common risks and gives you questions to ask a hosting provider or development partner. It is general educational guidance, not a replacement for a security assessment tailored to your systems or legal obligations.
1. Use HTTPS everywhere
HTTPS encrypts traffic between the visitor and your website. It helps protect form submissions, login sessions and page content from interception or modification in transit. Redirect every HTTP URL to its HTTPS equivalent, renew certificates automatically and remove mixed content such as images or scripts loaded over HTTP.
Google recommends HTTPS for user and site security, and browsers can mark HTTP pages as not secure. HTTPS is essential, but it does not prove that the website itself is free from malicious code or insecure business logic.
2. Keep the domain and DNS under business control
Your domain is a critical account. If someone gains control of it, they may redirect traffic, alter email records or impersonate the business. Register it using a company-controlled account, enable MFA, keep recovery details current and restrict administrative access.
- Turn on registrar lock where available.
- Use a unique password stored in a password manager.
- Enable DNS change notifications.
- Document who can renew or transfer the domain.
- Review old agency and employee access.
3. Choose maintained hosting and technology
Low-cost hosting is not automatically insecure, but the provider should offer supported software versions, HTTPS, backups, access logs and a clear process for incidents. Avoid abandoned themes, plugins and libraries. If a platform or framework no longer receives security fixes, plan migration rather than accepting permanent exposure.
4. Turn on multifactor authentication
Enable MFA for domain, hosting, CMS, email, analytics, source-code and cloud accounts. A stolen password alone should not be enough to control the website. Prefer authenticator apps, passkeys or security keys where available, and store recovery codes safely.
CISA places MFA alongside phishing awareness, strong passwords and software updates as core protective behaviours. Start with administrator and email accounts because they can often reset access to everything else.
5. Use unique passwords and a password manager
Reused passwords turn one breach into many compromised accounts. Use a reputable password manager to generate and store long, unique credentials. Never share one administrator login across the entire team; individual accounts create accountability and can be revoked without changing everyone’s access.
6. Apply least privilege
Give each person only the access required for their work. A writer may need to create drafts but not install plugins. An agency may need temporary deployment access but not permanent control of billing. Remove dormant accounts immediately after employees, freelancers or vendors leave.
7. Update the CMS, plugins and dependencies
Updates often correct known security weaknesses. Create an inventory of the CMS, themes, plugins, JavaScript packages, server software and third-party integrations. Enable safe automatic updates where appropriate and set a routine for testing changes that could affect checkout or forms.
Do not keep disabled plugins or old themes “just in case.” If they remain on the server, they can still expand the attack surface. Before a major update, create a backup and test the critical customer journey.
8. Follow secure development practices
Modern applications must treat every input as untrusted. Validate on the server, encode output, use parameterised database queries and keep secrets out of public repositories. Security headers, secure cookie settings, session expiration and careful file-upload rules add useful layers.
The OWASP Top 10 is a widely used awareness document for web-application risks. It includes categories such as broken access control, security misconfiguration, software supply-chain failures and injection. A checklist is a starting point; applications with accounts, payments or sensitive workflows need threat modelling, code review and appropriate testing.
9. Protect admin areas and APIs
Change default accounts, limit login attempts, monitor failed logins and avoid exposing unnecessary administration tools. APIs should authenticate requests, enforce permissions on every object and rate-limit abuse. Hiding an admin URL may reduce noise, but it is not a substitute for strong authentication and access control.
10. Reduce third-party script risk
Analytics, chat widgets, ad pixels, fonts and embeds run code or exchange data on your pages. Use only vendors you need, review their permissions, load scripts from trusted sources and remove old integrations. A smaller dependency set usually improves both security and performance.
11. Collect only the data you need
Every extra field creates storage, access and compliance responsibility. If a contact form only needs a name, email and project summary, do not request identity documents or sensitive personal details. Define how long submissions are retained and who can access them.
12. Secure forms, uploads and email
Use server-side validation, anti-automation controls and rate limits. Restrict upload file types and sizes, scan where appropriate and store uploads away from executable code. Do not expose form entries through guessable URLs or send sensitive data through insecure email workflows.
Phishing protection is also operational. Train team members to verify unexpected requests to change payment, domain or account settings. A convincing message can bypass technical controls if an authorised user is persuaded to act.
13. Keep payment scope small
For ecommerce, use a reputable payment provider and avoid handling raw card details unless your organisation is prepared for the resulting security and compliance responsibilities. Confirm that checkout pages, webhooks and API credentials are configured according to the provider’s current documentation.
14. Publish privacy and contact information
Explain what data the site collects and how people can contact the business. Cookie, consent and retention requirements depend on audience, location and tools, so obtain qualified legal advice where necessary. A copied privacy policy may not match the website’s actual behaviour.
15. Maintain tested, separate backups
A backup is useful only if it can be restored. Keep automatic backups on a schedule appropriate to how often data changes. Store at least one copy separately from the live hosting account so one compromised account cannot destroy both production and recovery files.
- Back up files, databases and critical configuration.
- Encrypt backup storage and restrict access.
- Define retention for daily, weekly and monthly copies.
- Test a restore instead of trusting a green status icon.
- Record recovery time and the person responsible.
16. Monitor availability and suspicious changes
Use uptime alerts, error logging and security monitoring appropriate to the platform. Watch for unexpected administrator accounts, changed files, new redirects, unusual traffic, failed logins and spikes in email delivery. Protect logs from unauthorised modification and keep them long enough to investigate an incident.
17. Prepare an incident-response plan
Do not design the plan during an emergency. Record who can take the website offline, contact the host, restore backups, reset credentials and communicate with customers. Preserve relevant logs before wiping systems, document the timeline and seek qualified incident-response and legal help when sensitive data may be involved.
| Frequency | Small-business security task |
|---|---|
| Every day/automatic | Uptime alerts, backup jobs, malware or integrity monitoring |
| Weekly | Review high-priority updates, failed logins and form abuse |
| Monthly | Apply remaining updates, review users, confirm backups and scan integrations |
| Quarterly | Restore test, access audit, dependency review and incident exercise |
| Annually | Renew risk assessment, policies, vendor review and professional testing as needed |
A launch-day website security checklist
- HTTPS works and HTTP redirects correctly.
- Domain, hosting and email use MFA.
- No shared or default administrator accounts remain.
- Software is supported and fully updated.
- Secrets and debug information are not publicly exposed.
- Forms validate input and resist automated abuse.
- Backups run automatically and a restore has been tested.
- Monitoring and responsible alert recipients are configured.
- Privacy information matches actual data collection.
- Ownership, support and incident contacts are documented.
The goal is not to claim a website is “100% secure.” The goal is to reduce risk, detect problems early and recover safely.
Frequently asked questions
Is an SSL certificate enough to secure a website?
No. HTTPS protects data in transit, but the website can still have weak passwords, outdated software, insecure access control or malicious code.
How often should a business website be updated?
Review security updates at least weekly and apply critical fixes promptly after appropriate testing. The exact schedule depends on the platform and risk.
Does a static website need security?
Yes. Static sites reduce some server-side risks, but domain, hosting, deployment accounts, third-party scripts and contact forms still require protection.
How often should backups be tested?
Test restores regularly—quarterly is a useful baseline for many small sites, while frequently changing ecommerce systems may need more frequent exercises.
Can a security plugin protect everything?
No single plugin covers account security, hosting, custom code, staff phishing, backups and incident response. Use layered controls.
Authoritative resources
- CISA Secure Our World: MFA, passwords, phishing awareness and software updates.
- OWASP Top 10: awareness of major web-application security risks.
- Google Search Central technical SEO guidance: HTTPS and user experience.
Pair this checklist with Editxify’s website development services, website cost guide and SEO services.
Planning a safer business website?
Editxify can build a fast, maintainable website with security fundamentals included from the start.
Discuss your website