Website security is not one setting or one plugin. A practical website security checklist combines software updates, protected administrator accounts, HTTPS, tested backups, traffic filtering, monitoring and a documented response plan.
Malware, phishing and distributed denial-of-service (DDoS) attacks also work differently. Malware may alter files or inject code, phishing targets people and credentials, while DDoS attacks try to exhaust network or application capacity. That is why a layered approach is more useful than relying on a single security feature.
Website Security Checklist
Use the following controls as a practical starting point:
- Keep the CMS, plugins, themes, libraries and server software updated.
- Remove unused software and unnecessary administrator accounts.
- Use unique passwords and multi-factor authentication for privileged access.
- Serve the site consistently over HTTPS and remove mixed content.
- Maintain tested backups of both files and databases.
- Use appropriate firewall, WAF, rate-limiting or DDoS-mitigation controls.
- Monitor logins, file changes, redirects, resource use and uptime.
- Document who responds when suspicious activity is detected.
1. Keep Software Updated
Outdated CMS software, plugins, themes, libraries and server components can contain publicly known vulnerabilities. Apply security updates promptly, while testing important changes before production deployment where practical.
Remove unused plugins and themes rather than leaving them installed. Every unnecessary component increases the amount of software that must be maintained and monitored. For important business websites, use staging for significant updates before applying them to the live site.
2. Protect Administrative Accounts
Use long, unique passwords for hosting, control-panel, CMS, database and email accounts. Avoid password reuse between services and remove accounts that no longer need access.
Enable multi-factor authentication wherever it is supported, especially for administrator and remote-access accounts. CISA recommends MFA for business systems and encourages phishing-resistant methods where available. See CISA’s multifactor authentication guidance for current recommendations.
Apply least privilege as well: contributors should receive only the permissions needed for their work. Review access after staff, contractor or agency changes.
3. Use HTTPS Correctly
TLS protects information while it moves between the visitor and the website. It helps protect login details, form submissions and other data in transit, but HTTPS is not a complete website-security solution.
A valid certificate does not fix vulnerable plugins, compromised passwords or malicious code. Force HTTPS consistently and remove mixed-content resources so secure pages do not load assets over insecure HTTP. If a browser is showing a warning, see our guide on how to fix a Connection Is Not Secure warning.
4. Create and Test Backups
Backups matter when malware, accidental deletion, failed updates or database corruption damage the site. Protect both website files and databases, keep an appropriate retention history and store at least one recovery copy separately from the live website where your setup allows it.
Do not assume a successful backup message proves recovery will work. Test restoration periodically and document the steps needed to rebuild the site. Recovery time is usually determined by how quickly a clean backup can actually be restored, not merely by whether a backup file exists.
5. Reduce Phishing and Email-Spoofing Risk
Phishing often targets people rather than the web server. Train staff to inspect sender addresses, links and attachments before acting, and avoid requesting passwords through ordinary email.
For domains used to send business email, SPF, DKIM and DMARC can help receiving systems evaluate whether messages are authorized. These controls do not eliminate phishing and they do not guarantee inbox placement. They work best as part of a wider email-security process. Our guide to email with your own domain explains these records in more detail.
6. Prepare for DDoS Traffic
A DDoS attack attempts to make a service unavailable by sending enough traffic or requests to exhaust network, server or application capacity.
Mitigation can include CDN caching, a web application firewall, rate limiting and provider-level filtering. Cloudflare’s current DDoS guidance notes that caching can reduce requests reaching the origin, while WAF and rate-limiting controls can filter or constrain unwanted traffic before it consumes application resources. See the DDoS prevention guidance for a technical explanation.
No CDN or firewall should be described as protection against every possible DDoS event. Capacity, configuration, attack type and upstream provider controls all matter. Ask a hosting provider what mitigation is actually included and what happens if an attack exceeds the service’s limits.
7. Monitor for Warning Signs
Watch for unexpected administrator accounts, changed files, unfamiliar redirects, repeated failed logins, unexplained CPU or bandwidth use, spam pages and browser security warnings.
Regular malware scanning and file-change monitoring can help identify suspicious activity, but one clean scan is not proof that a site has never been compromised. If a compromise is suspected, restrict access, preserve useful evidence and identify the initial entry point before considering the incident closed.
8. Review the Hosting Environment
Website security also depends on the environment in which the site runs. When evaluating hosting, check which controls are actually included rather than relying on broad phrases such as “secure hosting.”
Useful questions include whether backups are provided, what restoration process exists, how software isolation is handled, what traffic filtering or DDoS mitigation is available, how administrator access is protected and which security responsibilities remain with the customer. Current plan details should be checked on the relevant web hosting page rather than assumed from a general security article.
9. Build a Repeatable Security Routine
Assign recurring security work instead of leaving it to memory. A routine can include:
- software and dependency updates,
- administrator-access reviews,
- backup and restore checks,
- malware and file-integrity monitoring,
- uptime and resource monitoring,
- review of security alerts and unusual traffic.
No website can be guaranteed immune from attack. The practical objective is to reduce common weaknesses, detect unusual activity early and recover with as little disruption as possible.
Frequently Asked Questions
What should be included in a website security checklist?
At minimum, review software updates, administrator access, MFA, HTTPS, backups, malware monitoring, traffic filtering, DDoS readiness and incident-response ownership. The exact controls depend on the website’s technology and risk level.
How can I protect a website from malware and phishing?
Keep software updated, restrict privileged access, use unique credentials and MFA, monitor for suspicious changes, train users against phishing and maintain tested backups. Domain email authentication can also reduce some forms of spoofing.
Does HTTPS protect against all website attacks?
No. HTTPS protects data in transit, but it does not prevent malware, vulnerable software, stolen credentials or DDoS attacks.
Can a CDN stop every DDoS attack?
No. A CDN can help absorb or filter some attack traffic, but the result depends on architecture, configuration, provider capacity and attack type.
How often should website security be reviewed?
There is no single interval for every website. Review critical alerts immediately, apply important security updates promptly and schedule recurring checks for access, backups, monitoring and configuration based on the site’s risk and business importance.