Website security checklist for small businesses

You don't need a security team to make your website much harder to break into. This checklist covers what actually stops real-world attacks on business websites, online stores and startup apps. Work through it in order — the first sections matter most.

1. Take a backup before you change anything

• Make a full backup of your files and database, and download a copy to somewhere other than your hosting account.
• If your host offers automatic daily backups, check they're switched on and find out how long they're kept.
• Test a restore at least once. A backup you've never restored is a hope, not a plan.

2. Update everything — and remove what you don't use

Outdated software is the most common way into small websites. Once a vulnerability is published, bots start scanning for it within days.

• Update your CMS (WordPress, Joomla, etc.), themes, plugins and any code libraries.
• Delete plugins and themes you aren't using. Deactivated code can still be attacked.
• Replace plugins that haven't been updated by their developer in over a year.
• Make sure your server runs a PHP (or Node.js, Python) version that still receives security updates.
• Turn on automatic minor/security updates where your platform supports them.

3. Lock down logins

• Use a password manager and a long, unique password for every admin, hosting, domain, FTP and database account.
• Turn on two-factor authentication (2FA) for every admin account — and for your hosting and domain registrar too.
• Limit login attempts so bots can't guess passwords forever.
• Don't use "admin" or your domain name as a username.
• Remove accounts of former employees, agencies and freelancers. Give everyone else the lowest access they need.

4. HTTPS and security headers

• Every page should load over HTTPS, and plain http:// should redirect to it. Most hosts offer free SSL certificates.
• Add these HTTP security headers (your developer or host can set them in minutes):
  • Strict-Transport-Security — tells browsers to always use HTTPS.
  • Content-Security-Policy — limits which scripts can run, blocking many injection attacks.
  • X-Frame-Options or frame-ancestors — stops your site being embedded in someone else's page (clickjacking).
  • X-Content-Type-Options: nosniff and a sensible Referrer-Policy.
• Check your result for free at securityheaders.com.

5. Don't leave files lying around

• Make sure backups (.zip, .sql), .env files, old test pages and installer scripts are not in your public folder.
• Turn off directory listing, so visitors can't browse your folders.
• Hide detailed error messages from visitors — they often reveal file paths and software versions.

6. Protect your forms

• Validate every form on the server, not just in the browser.
• Add spam protection — a hidden honeypot field, rate limiting, or a CAPTCHA.
• Never put visitor input directly into database queries or email headers. Use your framework's safe functions.
• If you accept file uploads, restrict file types and never let uploaded files run as code.

7. Stop people faking your email

Criminals love sending invoices "from" small businesses. Three DNS records make that much harder, and also keep your real emails out of spam folders:

• SPF — lists the servers allowed to send email for your domain.
• DKIM — digitally signs your outgoing email.
• DMARC — tells receiving servers what to do with email that fails those checks. Start with p=none to monitor, then move to p=quarantine.

8. Review third-party scripts

• List every outside script on your pages: chat widgets, analytics, ads, payment and tracking pixels.
• Remove anything you no longer use. Each one is code from another company running on your site.

9. Watch for trouble

• Add your site to Google Search Console. It warns you if Google detects malware or hacked content.
• Set up free uptime monitoring so you know when the site goes down.
• Search site:yourdomain.com on Google now and then. Pages you didn't create are a red flag.

10. Know when to get a professional test

This checklist covers the basics. It can't find flaws in your own code — like one customer being able to see another's orders by changing a number in a link — or logic problems in checkout and login flows. Consider a professional security audit or penetration test if you:

• store customer data, take payments or have user accounts;
• have a client or investor asking for a security report;
• have never had your website checked by anyone.