Is a web application firewall enough on its own?

No. A WAF blocks a useful share of automated attacks but does nothing about stolen credentials, and a misconfigured origin can be reached directly. Treat it as one layer, not the plan.

How often should the checklist be reviewed?

Quarterly for most small sites, and after any change of platform, agency or hosting provider.

Website Securitybeginnerchecklist

Website Security Checklist

A prioritised checklist covering access, patching, backups, monitoring and response — ordered by how much risk each control removes.

Cyber Security Space editorial desk · Published 30 Jul 2026 · Updated 25 Aug 2026 · 2 min read · Reviewed 25 Aug 2026

Short answer

The controls that remove the most website risk, in order, are: multi-factor authentication on every administrative account, a real patching schedule for CMS and dependencies, tested off-site backups, least-privilege file and database permissions, monitoring of files and indexed pages, and a written response plan.

Key takeaways

Most website compromises trace back to credentials or an unpatched component, so those two controls come first.
An untested backup is not a backup; restore rehearsals are part of the control.
Monitoring is what converts a silent compromise into a same-week finding.
Security headers reduce blast radius but do not prevent initial access.

Access control

Multi-factor authentication on CMS, hosting panel, DNS and registrar accounts.
One account per person; no shared logins.
Remove contractor and ex-staff access on the day it ends.
Restrict administrative endpoints by IP or VPN where practical.

Patching and dependencies

A named owner and a fixed cadence for CMS, plugin, theme and library updates.
Remove unused plugins, themes and abandoned dependencies.
Subscribe to advisories for the components you actually run.
Track dependency vulnerabilities in CI where you have a build step.

Backups and recovery

Control	Minimum standard
Frequency	Daily for content, before every deploy for code
Location	Off-site, not writable from the web server
Retention	Long enough to predate a slow compromise — 30 days or more
Verification	A documented restore test at least quarterly

Monitoring and response

File integrity alerts on the web root.
Weekly review of indexed page counts and Search Console security issues.
Uptime and content-change monitoring on key pages.
A one-page response plan naming who does what, and where backups live.

Frequently asked questions

Is a web application firewall enough on its own?: No. A WAF blocks a useful share of automated attacks but does nothing about stolen credentials, and a misconfigured origin can be reached directly. Treat it as one layer, not the plan.
How often should the checklist be reviewed?: Quarterly for most small sites, and after any change of platform, agency or hosting provider.

Sources

Cyber Essentials — CISASupports: Baseline control priorities for small organisations.
OWASP Top 10 — OWASPSupports: Application-level risk categories referenced in the checklist.