Website Security Checklist: 15 Things to Verify Today

Most hacks are not sophisticated; they exploit the basics. Walk this list and you are ahead of most sites on the internet.

1. Strong, unique passwords with a manager
2. Two-factor authentication on every admin account
3. Core, plugin, and dependency updates applied weekly
4. Unused plugins and themes deleted, not just deactivated
5. Daily off-site backups you have actually tested restoring
6. Admin URLs not exposed; login attempt limiting on
7. Least-privilege user roles — editors do not need admin
8. Web application firewall enabled
9. Malware scanning scheduled
10. SSL everywhere, forced HTTPS
11. Security headers set (CSP, X-Frame-Options, nosniff)
12. File permissions tightened; no writable code directories
13. Database credentials rotated annually
14. Uptime and integrity monitoring with alerts
15. An incident plan: who to call, restore steps written down

Webnet's care plans run this checklist continuously, and our security team handles cleanups when things go wrong.