Website Security Checklist for Small Business: What to Check and When

A website security checklist for a small business comes down to a few habits: use HTTPS, keep software updated, protect logins with strong passwords and two-factor authentication, keep tested backups, limit who has admin access, remove unused plugins and watch for warning signs. This guide explains each item in plain language, with a monthly routine you can actually follow.

The website security checklist at a glance

Save this website security checklist on your phone. Each point is explained below, and none needs deep technical knowledge.

1. HTTPS everywhere: a valid SSL certificate, with all pages loading securely.
2. Updates: your CMS, theme and plugins on current versions.
3. Strong, unique passwords: kept in a password manager, never shared over chat.
4. Two-factor authentication: switched on for admin, hosting and domain accounts.
5. Fewer admins: only people who truly need full access, each with their own login.
6. Backups: automatic, stored away from the website, and restore-tested.
7. Plugin hygiene: fewer plugins, from trusted sources, deleted when unused.
8. Form protection: spam filtering and safe handling of enquiries.
9. Safe hosting: a provider that patches servers and offers backups and support.
10. Monitoring: you know what normal looks like, so odd changes stand out.
11. A response plan: you know the first steps if something goes wrong.
12. A monthly routine: twenty minutes a month keeps the rest from slipping.

SSL and HTTPS: the baseline

SSL, now usually provided as TLS, encrypts the connection between a visitor's browser and your server. When it is working, your address starts with https and the browser shows a padlock instead of a "not secure" warning. Any page with a contact form, login or payment step should be secure, and today every page should be.

Many hosting plans include a free certificate, but it must be switched on and renewed. Check three things. First, the certificate has not expired. Second, the plain http version of your address redirects to https. Third, no page shows "mixed content", which happens when an image or script still loads over http and the browser flags the page.

Keep your website software updated

Most small business sites run on a content management system such as WordPress, plus a theme and several plugins. Developers fix security weaknesses in updates, and those fixes are published for everyone to read. Automated tools that scan the internet for outdated versions use exactly this information, which is why old software is the most common way small sites get into trouble.

Good practice looks like this:

• Update the core software, theme and plugins regularly, not once a year.
• Take a backup before a major update, so you can roll back if something breaks.
• Test the home page, contact form and any checkout afterwards.
• Remove themes and plugins you are not using, even if they are switched off, because inactive code can still contain weaknesses.

If you built a WordPress site and are unsure who is looking after updates, find out. In many cases the answer is nobody. Our website maintenance services exist for exactly this gap.

Strong logins and two-factor authentication

Stolen or guessed passwords are a very common route into websites. Attackers often reuse passwords leaked from other services, so a password that you also use for email or a shopping app is a risk. A strong login has four parts.

• Long and unique: a passphrase of several unrelated words, different for every account.
• A password manager: so you do not need to remember or write passwords on paper or in a WhatsApp chat.
• No default usernames: avoid "admin" as the username on your site.
• Two-factor authentication (2FA): a second step, usually a code from an authenticator app, so a password alone is not enough.

Turn on 2FA first for the accounts that control everything: your hosting panel, your domain registrar, your website admin and the email address used to reset those passwords. App-based codes are generally safer than SMS codes, but any 2FA is better than none. Also avoid sharing one login among staff or with a freelancer. Create a separate user, and delete it when the work ends.

Limit admin users and permissions

Every admin account is a door into your site. A shop owner, an assistant who posts blogs, an old developer and a friend who once helped with photos should not all have full control. Give each person the lowest role that lets them do their job. A person who only writes blog posts needs an author or editor role, not an administrator role.

Review the user list every month. Remove people who have left, ex-agencies and old test accounts. Check for any admin user you do not recognise, because a new unknown admin is one of the clearest signs that something is wrong. Keep a short written list of who has access to what, including hosting, domain and email, so nothing is lost when staff change.

Backups in your website security checklist

A backup is your safety net for hacks, bad updates, accidental deletions and server failures. The common mistake is assuming the host takes care of it. Some plans include backups, some charge for them, and some keep them only for a few days, so ask your provider exactly what they store and for how long.

A sound backup setup has these features:

• Automatic: daily for a site that changes often, weekly for a site that rarely changes.
• Complete: both the files and the database, since orders, enquiries and pages live in the database.
• Stored elsewhere: at least one copy away from the web server, such as a cloud drive.
• Several versions: so you can go back to a date before a problem began, not just to yesterday.
• Restore-tested: try restoring on a test copy at least once, because an untested backup is only a hope.

Plugin and theme hygiene

Plugins add features, and every plugin adds code that someone must keep updated, so plugin hygiene belongs on any website security checklist. Before installing one, ask whether you really need it, whether it is still updated by its developer, and whether it comes from the official directory or the developer's own site.

Avoid pirated copies of paid themes and plugins. They often carry hidden code and never receive proper updates, so the saving can cost far more in repairs. If a plugin has not been updated for a long time, look for a maintained alternative, and delete anything you no longer use rather than just deactivating it. If your site's speed has also slipped because of too many add-ons, see our website speed optimization tips.

Protect forms from spam

Contact forms are public by design, so bots will find them, and form protection is an easy item to tick off on your website security checklist. Spam fills your inbox, hides real enquiries and, in the worst case, can be used to send junk email from your domain. Some practical protections:

• Add a spam filter or a simple challenge such as a CAPTCHA or a hidden "honeypot" field that real visitors never see.
• Send form emails through a proper mail setup rather than a bare server mail function, so genuine enquiries do not land in spam.
• Make sure the form actually delivers to you. Send a test message each month.

If you collect customer details, mention how you use them in your privacy policy. Our guide on website launch checks covers form testing before a site goes live.

Choose and use hosting carefully

Your hosting provider is part of your website security checklist, whether you planned it or not. A good host keeps its servers patched, isolates one customer's account from another, offers backups, supports current PHP versions and responds when you raise a problem. Very cheap shared plans can still be fine for a small brochure site, but ask what is included instead of assuming.

On your side, use a secure connection when you upload files (SFTP rather than plain FTP), delete old FTP accounts, keep file permissions at the recommended settings and do not leave old copies of the site, such as a folder named "backup" or "old-site", on the live server. Those forgotten copies are often unpatched and easy to find. If you are comparing providers, read how to choose web hosting in India before you buy or renew.

Warning signs your website may be hacked

Hacks are not always dramatic. Many stay hidden so the attacker can keep using your server. Add these signs to your website security checklist:

• Your site redirects visitors to unfamiliar pages, especially on mobile.
• Google or the browser shows a warning that the site may be unsafe.
• Pages or search results show strange text, pharmacy or gambling links, or titles in another language that you did not write.
• There are new admin users, plugins or files you did not add.
• Your site suddenly becomes slow, or your hosting provider warns you about unusual usage.
• Your emails start bouncing, or customers say they received spam from your address.
• You are locked out of your own admin and the password reset does not work.

One sign alone is not proof, since a slow site can have many harmless causes. Several together, or a warning from Google or your host, justify acting immediately. Hacked content can also damage how your pages appear in search, so keep an eye on your Google results as part of your SEO checklist.

What to do if your website is hacked

Stay calm and work in order. These steps are general, and the exact method depends on your platform and host. Every website security checklist should include a recovery plan like this.

1. Do not delete everything in panic. Note what you see and take screenshots, which will help whoever cleans the site.
2. Contact your host. They can sometimes confirm the problem, suspend the harmful files or restore a clean copy.
3. Change passwords. Reset the hosting, FTP, database, domain and website admin passwords, and your email password, from a clean device.
4. Turn on two-factor authentication wherever it is available.
5. Restore or clean. Either restore a backup from before the problem, or have a professional remove the malicious code and close the entry point.
6. Update everything after cleaning, remove unused plugins and delete unknown admin users.
7. Find the cause. If you only remove the symptoms and leave the weakness, the site can be infected again.
8. Check Google. If a warning was shown, request a review once the site is clean.
9. Tell people if needed. If customer data may be exposed, take advice on what to tell customers.

Cleaning a hacked site properly can be technical, so do not hesitate to ask for help. Ragnar Studios can support this under website maintenance, with scope and cost agreed after we look at your site. We have built 900+ websites and Shopify stores.

A simple monthly security routine

Security fails mostly through neglect, not clever attackers. A short repeated routine beats a big one-time effort. Put a monthly reminder in your calendar and run this website security checklist.

1. Take or confirm a fresh backup and check that it exists in a second location.
2. Update the core software, theme and plugins, then test your home page and contact form.
3. Review the user list and remove accounts that are no longer needed.
4. Delete unused plugins and themes.
5. Check that your SSL certificate is valid and note its renewal date.
6. Send a test enquiry through your form and read your spam folder for genuine messages.
7. Check that domain and hosting renewals are paid, since an expired domain is also a security problem.

Frequently asked questions