This checklist is a starting point for website owners. It does not replace a professional assessment, but it can help you spot common areas that deserve attention.
1. Protect administrator accounts
- Enable multi-factor authentication wherever supported.
- Remove unused accounts and review administrator permissions.
- Use unique passwords stored in a reputable password manager.
2. Keep the website maintained
- Update the content management system, plugins, themes and dependencies.
- Remove software and extensions that are no longer needed.
- Use a documented process for testing updates and recovering if they fail.
3. Review HTTPS and configuration
- Confirm that HTTPS works throughout the site and renewals are monitored.
- Prevent directory listings and avoid exposing backup files or configuration files.
- Review security headers and cookie settings where appropriate.
4. Back up and practise recovery
- Keep protected backups separate from the main website account where possible.
- Restrict who can delete or change backups.
- Test restoring a backup instead of assuming it will work.
5. Prepare for incidents
- Record hosting, domain and key supplier support contacts securely.
- Know how to disable compromised accounts and preserve relevant evidence.
- Agree who communicates with customers and who coordinates recovery.
When to get help
If you suspect a compromise, avoid making unplanned changes that could destroy useful evidence. Contact your hosting provider or an appropriate incident response professional. For a planned review, explore the website security review service.
Checklist reviewed for general educational use. Your requirements depend on your platform, data, contracts and applicable regulations.