This checklist is written for non-technical business owners, marketers, and anyone who runs a website without a dedicated IT team. Each item is explained in plain English. Items marked Critical should be addressed first — they represent the highest risk if left unchecked.
Section 1: HTTPS and basic encryption
Your site uses HTTPS Critical
HTTPS encrypts the connection between your visitors' browsers and your server. Without it, anyone on the same network can read the data passing between them and your site — including passwords, personal details, and payment information. Every modern website should use HTTPS. Check that your URL starts with https:// and that a padlock icon appears in the browser bar. Most hosting providers offer free HTTPS certificates through Let's Encrypt.
HTTP redirects to HTTPS automatically
Having an SSL certificate is not enough if your site can still be loaded over plain HTTP. Make sure your server is configured to automatically redirect any visitor who loads http://yoursite.com to https://yoursite.com. Many hosting panels have a one-click setting for this. Without the redirect, some visitors — especially those who click old links — may end up on the unencrypted version of your site without realising it.
Section 2: Login and authentication security
Strong, unique passwords are used on all accounts Critical
Weak or reused passwords are one of the most common ways business websites get compromised. This includes your website admin panel, your hosting control panel, your domain registrar, and any email accounts associated with the domain. Use a password manager to generate and store strong unique passwords for every account. A strong password is at least 16 characters, random, and not used anywhere else.
Two-factor authentication (2FA) is enabled on admin accounts Critical
Two-factor authentication means that even if an attacker gets hold of your password, they still cannot log in without a second factor — usually a time-based code from an app like Google Authenticator. Enable 2FA on your hosting control panel, domain registrar, and website admin account. This single step stops the majority of account takeover attacks cold.
Your admin panel URL is not the default
WordPress sites are commonly attacked at the default /wp-admin login URL because attackers know it is there on almost every WordPress installation. Consider moving your admin login page to a custom URL. Most security plugins for WordPress include this option. This does not replace strong passwords and 2FA, but it significantly reduces automated brute-force attempts by making the login page harder to find.
Login attempts are rate limited
Brute force attacks work by trying thousands of password combinations automatically. Rate limiting your login page — locking it out temporarily after a certain number of failed attempts — makes this impractical. Most CMS platforms have plugins or built-in options for this. If you are running a custom web application, your development team should implement rate limiting directly in the authentication code.
Section 3: Software and plugin updates
Your CMS, plugins, and themes are up to date Critical
Outdated software is one of the most common entry points for attackers. When a security vulnerability is discovered in WordPress, a popular plugin, or any other web software, a patch is usually released quickly — but attackers also know about the vulnerability and immediately start scanning for unpatched sites. Keeping everything updated is one of the highest-impact security steps you can take. Enable automatic updates where possible.
Unused plugins and themes are removed
Plugins and themes that are installed but inactive can still be exploited if they contain vulnerabilities. Remove anything you are not using. The fewer plugins you have installed, the smaller your attack surface. Audit your installed plugins periodically and remove any that you have not used in the past six months or that are no longer being maintained by their developers.
Section 4: Backups
Automatic backups are configured and tested Critical
If your site is compromised, a recent backup is often the difference between a few hours of recovery work and losing everything. Configure automatic daily or weekly backups of both your files and your database. Store backups somewhere separate from your hosting account — if your hosting account is compromised, backups stored there may also be affected. Test your backup restoration process at least once to make sure it actually works.
Section 5: Security headers
Key security headers are present in your server responses
HTTP security headers are instructions your server sends to browsers telling them how to behave when loading your site. Headers like Strict-Transport-Security (forces HTTPS), X-Frame-Options (prevents clickjacking), and X-Content-Type-Options (prevents MIME sniffing) are simple to add and provide meaningful protection. Many hosting providers and web frameworks make this straightforward to configure. See our security headers guide for a complete explanation of each one.
Section 6: User data and forms
Contact forms and inputs are protected against spam and injection
Unprotected forms are frequently abused for spam, automated attacks, and in some cases, code injection. Add a CAPTCHA or honeypot field to your contact and registration forms to deter automated submissions. If your site accepts any user-generated content that is displayed to other visitors — comments, reviews, forum posts — make sure it is properly sanitised before display to prevent cross-site scripting (XSS) attacks.
You only collect the minimum data you need
The best way to protect customer data is to not collect it in the first place if you do not need it. Every piece of customer data you store is a liability — if you are breached, that data is at risk. Review your forms and databases. Are you collecting information that you never actually use? If so, stop collecting it and delete what you already have. This is also a legal requirement in many jurisdictions under privacy laws like GDPR and the Australian Privacy Act.
Section 7: Run a security scan
Going through a checklist manually is a good start, but it cannot tell you about vulnerabilities in your site's code, misconfigured server settings, or exposed sensitive files. An automated security scan tests your live site directly and identifies issues that are invisible from the outside.
Free security scan
ScanexAI runs an automated security scan on your live website and checks for over 40 vulnerability types — including missing security headers, exposed admin panels, brute force vulnerabilities, XSS, IDOR, and AI-specific risks. You get a plain-English report with a risk score and step-by-step fix guidance. Run your first scan free — no technical setup required.
Summary
Protecting a small business website does not require a security expert or a large budget. The highest-impact steps are: using HTTPS, enabling two-factor authentication on admin accounts, keeping software updated, maintaining regular backups, and limiting the data you collect. These basics address the majority of how small business sites actually get compromised.
Once the fundamentals are in place, a periodic automated security scan is the most practical way to stay on top of new issues as your site changes over time. Treat it as routine maintenance, the same way you keep your software updated.