Website Security Checklist for Small Businesses: Complete 2026 Guide

A hacked website costs far more than prevention.

Average cost of a small business data breach: $120,000–$1.24M (IBM/Ponemon 2024) 60% of small businesses close within 6 months of a cyber attack (US National Cyber Security Alliance) 43% of cyber attacks target small businesses — yet only 14% are prepared (Accenture)

This checklist covers every layer of website security. Use it as your quarterly audit. Check off each item. Fix gaps immediately.

Quick-start: the 5 non-negotiables (do these today)

If you only do these five, you’re ahead of 80% of small businesses.

Complete website security checklist

1. SSL / HTTPS / Transport Security

• Valid SSL/TLS certificate — Let’s Encrypt (free) or paid (DigiCert, Sectigo). Auto-renewal enabled.
• HTTPS enforced site-wide — 301 redirect HTTP → HTTPS. No mixed content.
• HSTS header — Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
• Secure cookies — Secure; HttpOnly; SameSite=Strict on session cookies
• TLS 1.2+ only — Disable TLS 1.0, 1.1, SSLv2, SSLv3 on server
• Certificate transparency monitoring — Check for rogue certificates (crt.sh, SSLMate)

Test: SSL Labs Server Test — aim for A+

2. Access Control & Authentication

• Unique admin usernames — Never “admin”, “administrator”, “root”, business name
• Strong passwords — 16+ chars, generated/stored in password manager (Bitwarden, 1Password)
• Two-factor authentication (2FA) — Required for all admin/editor accounts (TOTP app, not SMS)
• Limit login attempts — 5 failed = 15-min lockout; notify admin
• Disable XML-RPC (WordPress) — Unless actively used for Jetpack/mobile app
• Restrict admin access by IP — If team works from fixed IPs (.htaccess, Cloudflare, server config)
• Separate accounts per person — No shared logins. Audit quarterly.
• Remove unused accounts — Former employees, contractors, test accounts
• Least privilege principle — Editors edit content; only admins install plugins/update core

3. Core Software Updates (Automate Where Possible)

• CMS core — WordPress, Drupal, Joomla, Ghost, etc. Auto-update minor; test major
• All plugins/extensions/modules — Remove unused. Update weekly.
• Themes — Update parent + child themes. Delete unused themes.
• PHP version — PHP 8.2+ required. 8.0/8.1 EOL. Ask host to upgrade.
• Database — MySQL 8.0+ / MariaDB 10.6+. Update via host.
• Web server — Nginx/Apache/LiteSpeed updated by host (verify)
• Operating system — Host responsibility (ask for patch schedule)

WordPress: Enable auto-updates for plugins/themes in wp-config.php or via security plugin.

4. Malware Protection & Scanning

• Active malware scanner — Wordfence (WP), Sucuri, MalCare, Imunify360 (server-level)
• Scheduled scans — Daily quick scan; weekly full scan
• Real-time firewall/WAF — Blocks known attack patterns (SQLi, XSS, RCE, bad bots)
• File integrity monitoring (FIM) — Alerts on core file changes (Wordfence, Tripwire, AIDE)
• Block PHP execution in uploads — .htaccess or Nginx rule: location ~* /uploads/.*\.php$ { deny all; }
• Disable file editing in admin — WordPress: define('DISALLOW_FILE_EDIT', true);
• Quarantine suspicious files — Don’t delete immediately; investigate first

5. Backups & Disaster Recovery

• Automated daily backups — Files + database. Off-site (cloud storage, not same server).
• Retention policy — 30 daily + 12 weekly + 12 monthly minimum
• Test restores quarterly — Restore to staging; verify integrity, functionality
• Backup encryption — Encrypt at rest (AES-256) and in transit (TLS)
• Separate backup credentials — Backup storage uses different auth than server
• One-click restore — Documented, tested procedure. Time-to-restore < 30 min.
• Database-only backup option — For quick content rollbacks

Tools: UpdraftPlus, BlogVault, Jetpack Backup, SnapShooter, host-provided (verify off-site)

6. WordPress-Specific Hardening (if applicable)

• Change default database prefix — wp_ → wpxyz_ (during install or via plugin)
• Disable XML-RPC — add_filter('xmlrpc_enabled', '__return_false');
• Disable REST API for non-authenticated — Unless headless/block editor needs it
• Hide WordPress version — remove_action('wp_head', 'wp_generator');
• Block author enumeration — Prevent ?author=1 scans
• Limit password reset attempts — Prevent reset abuse
• Secure wp-config.php — Move above web root; restrict permissions (400/440)
• Disable plugin/theme install/update via admin — If managed via Git/Composer
• Use security headers plugin — Or configure at server level (see Section 8)

7. Form & Input Security

• CSRF tokens on all forms (nonce in WordPress)
• CAPTCHA/honeypot on contact, login, registration forms
• Input sanitization & validation — Server-side, not just client-side
• File upload restrictions — Whitelist extensions (jpg, png, pdf); max size; scan uploads
• Store uploads outside web root — Or serve via script with auth check
• Rate limiting — Per IP on forms, login, search, API endpoints

8. Security Headers (Configure at Server/CDN Level)

Test: SecurityHeaders.com — aim for A

9. CDN & Edge Security (Cloudflare, BunnyCDN, CloudFront)

• WAF enabled — OWASP Top 10 rules + managed rulesets
• Bot management — Block known bad bots; challenge suspicious
• Rate limiting — Login, API, search endpoints (e.g., 10 req/min/IP)
• DDoS protection — Automatic mitigation (free tier on Cloudflare)
• SSL/TLS mode — Full (Strict) — encrypts origin ↔ edge ↔ visitor
• Cache purge on deploy — Prevents stale content
• Origin shield — Hide origin IP (Cloudflare: “Orange Cloud” proxied)

10. Monitoring & Alerting

• Uptime monitoring — 1-min checks; alert on downtime (UptimeRobot, Better Uptime, Pingdom)
• SSL expiry monitoring — Alert 30/14/7 days before expiry
• Malware scan alerts — Email/Slack on detection
• File change alerts — FIM notifications for core files
• Failed login alerts — Brute force detection
• Admin login notifications — Know every admin access
• Backup success/failure alerts — Don’t assume backups ran
• Error rate monitoring — 5xx spikes = attack or breakage

11. Incident Response Plan (Documented, Accessible)

• Contact list — Host support, developer, security consultant, legal
• Isolation procedure — Maintenance mode, block traffic, pull origin from CDN
• Forensic steps — Preserve logs, database, files before cleanup
• Cleanup procedure — Malware scan → remove → verify → patch → restore
• Communication template — Customer notification (if data breach)
• Post-incident review — Root cause, lessons, checklist updates
• Legal/compliance obligations — GDPR, CCPA, HIPAA, PCI-DSS notification timelines

12. Compliance & Privacy (If Applicable)

• Privacy policy — Current, accessible, covers analytics, forms, cookies
• Cookie consent banner — GDPR/ePrivacy compliant (Cookiebot, Complianz, Termly)
• Data processing agreements — With hosts, analytics, email providers
• PCI-DSS — If accepting payments directly (use Stripe/PayPal to avoid scope)
• GDPR/CCPA — Data access/deletion requests process documented
• Accessibility (WCAG 2.1 AA) — Not strictly security, but legal risk

Platform-specific quick reference

WordPress (5-minute hardening)

// wp-config.php additions
define('DISALLOW_FILE_EDIT', true);
define('WP_AUTO_UPDATE_CORE', 'minor');
define('AUTOMATIC_UPDATER_DISABLED', false);

// .htaccess (Apache) or Nginx config
# Block PHP in uploads
<FilesMatch "\.php$">
    Order Deny,Allow
    Deny from All
</FilesMatch>

# Protect wp-config.php
<Files wp-config.php>
    Order Allow,Deny
    Deny from all
</Files>

Install: Wordfence (free) → enable firewall, 2FA, login limits, scans Configure: Cloudflare (free) → SSL Full Strict, WAF, Bot Fight Mode, Rate Limiting

Static Sites (Astro, Next.js, Hugo, Jekyll)

• Deploy via Git — No FTP/SFTP credentials on server
• Edge functions — Auth, rate limiting, headers at edge (Vercel, Netlify, Cloudflare Pages)
• Dependency scanning — npm audit, Snyk, GitHub Dependabot in CI
• Content Security Policy — Strict CSP (no 'unsafe-inline' if possible)
• Environment variables — Secrets in platform dashboard, never in repo

Custom / Headless / Ecommerce

• API authentication — JWT/OAuth2, short expiry, refresh tokens
• Rate limiting — Per user/IP on all endpoints
• Input validation — Schema validation (Zod, Joi, Pydantic) on every endpoint
• Database security — Parameterized queries only; least-privilege DB user
• Payment security — Never handle raw card data. Use Stripe Elements, PayPal SDK.
• Admin panel — Separate subdomain, IP-restricted, 2FA mandatory

Quarterly security audit checklist

Security budget: what to spend where

Total: ~$600–2,000/year — vs. $120K+ average breach cost.

FAQ: website security for small businesses

How often should I run a security scan?

Daily automatic (quick) + weekly full scan + manual after any update or suspicious activity. Most security plugins handle scheduling.

Do I need a security plugin if my host has a firewall?

Yes. Host firewall (network layer) + application firewall (Wordfence/Cloudflare) = defense in depth. They catch different things.

What’s the most common way small business sites get hacked?

1. Weak/stolen credentials (no 2FA, password reuse)
2. Vulnerable plugins/themes (outdated, nulled/pirated)
3. Outdated PHP/CMS (unpatched known exploits)
4. Malicious file uploads (no validation, PHP execution enabled)
5. Compromised admin device (keylogger, malware)

Can I secure my site without a developer?

Yes, for 80% of this checklist. Hosting, Cloudflare, security plugin, backups, 2FA, updates — all doable via UI. Items needing dev: custom CSP, server config, API security, custom code review.

What should I do if my site is hacked right now?

1. Put site in maintenance mode (block all traffic)
2. Change all passwords (hosting, CMS, database, FTP, email)
3. Scan with multiple tools (Wordfence, Sucuri SiteCheck, MalCare)
4. Restore from clean backup (pre-hack date)
5. Update everything (core, plugins, PHP)
6. Re-scan. Verify clean. Remove maintenance mode.
7. Post-incident: audit how they got in; close the gap.

Is a free SSL certificate (Let’s Encrypt) enough?

Yes, for encryption. Paid certificates add: warranty, organization validation (OV/EV), support, longer validity. For most small businesses, Let’s Encrypt + auto-renewal is sufficient.

How do I know if my backups actually work?

Test restore to staging quarterly. Verify: site loads, admin works, content intact, forms submit, no malware. Document time-to-restore. If > 30 min, improve process.

Final recommendation: security is a habit, not a project

Daily:    Auto-updates, scans, backups, monitoring alerts
Weekly:   Plugin/theme updates, log review, backup verify
Monthly:  User audit, SSL check, WAF log review
Quarterly: Full restore test, header audit, incident drill, penetration scan
Annually:  Professional audit, compliance review, disaster recovery test

The businesses that get hacked are the ones that “set and forget.”

Need a security audit or ongoing maintenance? Contact TheWebPal for a complete website security assessment, hardening implementation, and monthly maintenance plans. We’ll lock down your site so you can focus on your business.

Related resources

• Shared Hosting vs VPS vs Cloud Hosting
• How Website Speed Affects SEO and Sales
• Top WordPress Plugins & Tools for Faster, More Secure Websites
• The Ultimate Guide to Web Hosting, Website Design & Online Growth for Small Businesses
• Best Web Hosting Services for Small Business Websites in 2026
• How to Fix a Slow WordPress Website
• Website Backup Guide for Business Owners
• SSL Certificate Guide for Beginners