Website Security Checklist: 12 Things to Check This Month

Website security doesn’t have to mean becoming a technical expert overnight. Most of what actually protects a small business site comes down to a short list of concrete, checkable items. Set aside twenty minutes this month and work through this list — you’ll either confirm you’re in good shape, or find exactly what needs attention.

Software & access

• WordPress core, all themes, and all plugins are updated to their latest versions
• Any plugins or themes you no longer use are fully deleted, not just deactivated
• No plugins were installed from unofficial or “nulled” sources
• Every admin account uses a strong, unique password not reused elsewhere
• Old or unused user accounts have been removed

Protection layers

• A firewall (WAF) is active and confirmed, not just assumed to be included with hosting
• Login attempts are rate-limited or protected by two-factor authentication
• SSL/HTTPS is properly configured with no mixed-content warnings
• Key security headers are in place (or you know they’re currently missing)

Data & recovery

• Backups run automatically at a frequency that matches how often your site changes
• Backups are stored off-site, separate from your main hosting account
• At least one backup restore has actually been tested

Visibility & monitoring

• Your domain has been checked against Google Safe Browsing and other malware blacklists recently
• No unfamiliar files exist in your uploads directory
• You’re not relying purely on “the site looks fine” as your security check
• Someone is actually reviewing scan results or reports on an ongoing basis, not just running a one-time check

If you found gaps

That’s normal — most sites we check have at least a few items on this list unaddressed, often without the owner realizing it. The goal of this checklist isn’t to create anxiety, it’s to replace uncertainty with a clear, specific to-do list you can actually act on.