Website Security Checklist: 20 Steps for Small Businesses

Most website attacks aren’t personal. Automated bots scan millions of sites looking for outdated software, weak passwords and known vulnerabilities, and they move fast. Patchstack’s State of WordPress Security in 2026 report counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025 (91% of them in plugins), and found that heavily targeted vulnerabilities were typically exploited within about five hours.

The good news is that a handful of basic habits block most of these attacks. In this checklist I’ve grouped 20 practical steps into five areas, based on guidance from the UK’s National Cyber Security Centre (NCSC), OWASP and Patchstack’s research. Most apply to any website; I’ve added WordPress-specific notes where relevant.

Quick checklist

Area	Steps
Software	Update core, plugins and themes; remove unused ones; choose software carefully
Access	Strong unique passwords, two-factor authentication, least privilege, remove old users
Backups	Automatic, off-site, tested restores
Server and hosting	HTTPS, secure hosting, current PHP, firewall
Monitoring and recovery	Activity logs, uptime and malware alerts, incident plan

Software and updates

1. Keep everything updated

Updates fix security holes. Patchstack reports that a large share of attacks target vulnerabilities that already have a fix available but haven’t been applied.

Turn on automatic updates for WordPress minor releases (on by default) and for trusted plugins.
Check for updates at least weekly.
Test major updates on a staging site if your site is business-critical.

2. Remove what you don’t use

Deactivated plugins and old themes can still contain vulnerable code. Delete anything you aren’t using, including default themes you don’t need (keep one as a fallback).

3. Choose plugins and themes carefully

Before installing, check:

when it was last updated
the number of active installations and recent reviews
whether the developer responds to support questions
that you’re downloading it from the official directory or the developer’s own site, never from “nulled” (pirated) download sites, which often contain malware

Patchstack found that 46% of 2025’s vulnerabilities had no developer fix available when they were made public, so fewer, well-maintained plugins means less risk.

4. Know the common web risks

If you or your developer build custom features, check them against the OWASP Top 10:2025, the standard list of the most critical web application risks. Broken access control is number one, followed by security misconfiguration and software supply chain failures (risks from the third-party code you depend on).

Access and logins

5. Use strong, unique passwords

Every admin, hosting, domain, email and database account needs a different, long password. Use a password manager to generate and store them. The NCSC recommends using three random words as a memorable approach where you must remember a password.

6. Turn on two-factor authentication (2FA)

2FA means a stolen password alone isn’t enough to log in. Enable it on:

your website admin (via a security or 2FA plugin on WordPress)
your hosting account
your domain registrar
the email accounts used for password resets

7. Give people only the access they need

On WordPress, use the right roles: Editor for people who manage content, Author for writers, and Administrator only for the few who manage the site. Remove access as soon as someone leaves or a project ends.

8. Review user accounts regularly

Every few months, check for accounts you don’t recognise or no longer need, especially admin accounts. An unexpected admin user is a classic sign of a hack.

Bots try thousands of password guesses. Use a plugin or your host’s firewall to limit failed logins and block repeat offenders. Changing the login URL (for example with WPS Hide Login) reduces noise, but it’s not a replacement for strong passwords and 2FA.

Backups

10. Back up automatically

Use your host’s backups or a backup plugin to back up your files and database, ideally daily for active sites.

11. Keep copies off-site

The NCSC advises keeping backups separate from the systems they protect, for example in cloud storage, and protecting that storage with 2-step verification. A backup stored only on the same server can be lost or encrypted along with the site.

12. Test restoring

A backup you can’t restore isn’t a backup. The NCSC recommends practising a restore so you know it works and contains everything you need. Try restoring to a staging site every few months.

Server and hosting

13. Use HTTPS everywhere

An SSL/TLS certificate encrypts data between your visitors and your site. Most hosts offer free certificates. Make sure every page redirects from http:// to https://.

14. Choose secure hosting

Good hosts provide isolated accounts, server-level firewalls, malware scanning, automatic backups and quick security patching. Cheap hosting that skips these often costs more after a hack.

15. Run a supported PHP version

Old PHP versions stop getting security fixes. WordPress.org recommends PHP 8.3 or newer. You can usually change it in your hosting control panel; check Tools › Site Health first.

16. Use a web application firewall (WAF)

A WAF filters malicious traffic before it reaches your site. Options include your host’s firewall, a cloud service such as Cloudflare, or a security plugin. Some services also offer virtual patching, which blocks attacks on known vulnerabilities before an official fix is available.

17. Harden your configuration

Disable file editing in the WordPress dashboard by adding define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php.
Use secure file permissions (your host can advise).
Don’t leave backup files, old installs or test folders in your public web directory.
Hide detailed error messages from visitors on a live site.

Monitoring and recovery

18. Monitor your site

Uptime monitoring alerts you if your site goes down.
Malware and file-change scanning spots injected code.
Activity logs show who changed what.
Google Search Console emails you about security issues and manual actions. See my Search Console tutorial.

19. Protect your forms and email

Add spam protection to contact and comment forms.
Set up SPF, DKIM and DMARC for your domain so attackers can’t easily send email pretending to be you. My email marketing guide explains these records.

20. Have a recovery plan

Write down, before you need it:

who to contact (your host, developer, security service)
where your backups are and how to restore them
how to change all passwords quickly
how to tell customers if their data may have been affected, and what your local data protection rules require

Signs your site may be hacked

unfamiliar admin users or plugins
spam pages or links you didn’t create (search site:yourdomain.com in Google)
redirects to other sites, especially on mobile
a browser or Google warning that the site is unsafe
sudden traffic drops or a spike in server resource use
your host suspending the account

If you see these, put the site in maintenance mode, contact your host, restore a clean backup if you have one, update everything, and change every password. If your site shows a server error rather than malware, my guide to the WordPress 500 internal server error may help.

Frequently asked questions

Is WordPress secure? WordPress core is well maintained; Patchstack recorded only six low-priority core vulnerabilities in 2025. Most risk comes from outdated plugins and themes, weak passwords and poor hosting.

Do I need a security plugin? It helps, especially for 2FA, login limits, firewall rules and scanning. But no plugin replaces updates, strong passwords and backups.

How often should I back up my website? Daily for sites that change often, such as shops and busy blogs. Weekly may be enough for a small site that rarely changes. Always back up before major updates.

Does HTTPS make my site secure? HTTPS protects data in transit between the visitor and your site. It doesn’t stop hacks caused by outdated software or stolen passwords, so you still need the rest of this checklist.

Sources

Patchstack: State of WordPress Security in 2026
OWASP: Top 10:2025
National Cyber Security Centre: Backing up your data
WordPress.org: Requirements

Website Security Checklist: 20 Steps to Protect Your Site

Quick checklist