Blog
Website Security Checklist
A prioritised checklist covering access, patching, backups, monitoring and response — ordered by how much risk each control removes.
Published 30 Jul 2026 · Updated 25 Aug 2026 · 2 min read
Short answer
The controls that remove the most website risk, in order, are: multi-factor authentication on every administrative account, a real patching schedule for CMS and dependencies, tested off-site backups, least-privilege file and database permissions, monitoring of files and indexed pages, and a written response plan.
Access control
- Multi-factor authentication on CMS, hosting panel, DNS and registrar accounts.
- One account per person; no shared logins.
- Remove contractor and ex-staff access on the day it ends.
- Restrict administrative endpoints by IP or VPN where practical.
Patching and dependencies
- A named owner and a fixed cadence for CMS, plugin, theme and library updates.
- Remove unused plugins, themes and abandoned dependencies.
- Subscribe to advisories for the components you actually run.
- Track dependency vulnerabilities in CI where you have a build step.
Backups and recovery
| Control | Minimum standard |
|---|---|
| Frequency | Daily for content, before every deploy for code |
| Location | Off-site, not writable from the web server |
| Retention | Long enough to predate a slow compromise — 30 days or more |
| Verification | A documented restore test at least quarterly |
Monitoring and response
- File integrity alerts on the web root.
- Weekly review of indexed page counts and Search Console security issues.
- Uptime and content-change monitoring on key pages.
- A one-page response plan naming who does what, and where backups live.
Sources
- Cyber Essentials — CISA
- OWASP Top 10 — OWASP
Prefer summary updates? Subscribe to the newsletter.