Website security is not a one-time plugin or certificate. It is a collection of small controls that reduce the chance of an attack, limit the damage if something goes wrong and help the business recover quickly.
Small companies are not too small to be targeted. Automated scanners continuously look for outdated software, weak passwords and exposed administration pages. Use this checklist to review the essentials with your developer or hosting provider.
1–3: Protect every account
Start with the people who can change the website. Give each person their own account, remove access when it is no longer needed and reserve administrator permissions for work that genuinely requires them.
Use long, unique passwords stored in a password manager and enable multi-factor authentication wherever it is available. Never reuse the website administrator password for email, hosting or domain accounts.
- Use unique accounts and least-privilege permissions
- Store unique passwords in a reputable password manager
- Enable multi-factor authentication for CMS, hosting, email and domain accounts
4–6: Keep the software healthy
Outdated content-management software, themes and plugins are common entry points. Apply security updates promptly, remove anything unused and only install software from reputable sources.
HTTPS is essential, but it only encrypts information in transit; it does not prove the website itself is secure. Confirm the certificate renews automatically and redirect every page to HTTPS.
- Update the CMS, plugins, themes and server software
- Delete unused plugins, themes, accounts and staging sites
- Enforce HTTPS across the entire website
7–9: Prepare to detect and recover
Backups matter only when they can be restored. Keep automated copies on a schedule that reflects how often the site changes, store at least one copy away from the main server and test restoration.
Monitoring should alert someone when the site goes offline, files change unexpectedly or repeated login attempts occur. Logs help determine what happened instead of forcing the team to guess.
- Maintain automated, off-site backups and test recovery
- Monitor uptime, file changes, malware and suspicious logins
- Retain useful access, application and security logs
10–12: Secure the wider system
A website depends on its domain, DNS, email, hosting and third-party services. A strong CMS password cannot protect a domain account compromised through weak email security.
Use a reputable host, protect forms against spam and abuse, and keep a short incident plan stating who to contact, how to take the site offline safely, where backups live and how customers will be informed if their data is affected.
- Secure domain, DNS, email and hosting accounts
- Protect forms, APIs and payment integrations; never store data you do not need
- Document an incident response and recovery plan
How often should you review security?
Review access and updates monthly, confirm backups and monitoring regularly, and perform a deeper assessment after major changes. E-commerce, membership and customer portals deserve more frequent attention because they process accounts, payments or personal information.
No checklist guarantees that an attack will never happen. Good security reduces avoidable exposure and makes recovery faster and more controlled.
Not sure what your website is exposing?
Bisops can review the website, explain the risks clearly and prioritise the fixes.