Web Development Checklist

Website Security Checklist

A website security checklist for reducing risk from outdated software, weak access control, malware, spam, missing backups, and preventable downtime.

Primary topic: website security checklist Difficulty: Intermediate 36 items 3,420+ words Updated: June 8, 2026

Interactive Checklist

Track Your Progress

Check items off as you complete them. Your progress is saved in this browser so you can return to the checklist later.

0% complete

Access Control

This section helps the reader complete the access control portion of the Website Security Checklist with a practical, evidence-based workflow.

Use this section to make sure access control is not treated as a vague best practice. Each item should be checked, documented, and tied back to the business goal of the checklist.

Use strong unique admin passwords Use use strong unique admin passwords only when it helps the user complete a task or understand the offer. Avoid adding elements only because they are common best practices. Critical Strategist Screenshot, report export, URL, test submission, or implementation note
Enable two-factor authentication Complete this item with enough evidence for another strategist, developer, or account manager to understand what was checked and why it matters for Website Security Checklist. Critical Strategist Screenshot, report export, URL, test submission, or implementation note
Remove unused users Remove or avoid remove unused users when it creates risk, confusion, wasted spend, duplicate content, tracking errors, or a poor user experience. Document the reason for the decision. High Strategist Screenshot, report export, URL, test submission, or implementation note
Limit admin roles Complete this item with enough evidence for another strategist, developer, or account manager to understand what was checked and why it matters for Website Security Checklist. High Strategist Screenshot, report export, URL, test submission, or implementation note
Review agency and vendor access Review review agency and vendor access against the current business goal for this page or campaign. Capture the issue, evidence, recommended fix, owner, and priority so the checklist becomes an implementation plan rather than a passive review. Recommended Strategist Screenshot, report export, URL, test submission, or implementation note
Document account ownership Document document account ownership in plain language before work begins. This keeps strategy, creative, development, and reporting aligned and gives future reviewers a clear reason for each decision. Recommended Strategist Screenshot, report export, URL, test submission, or implementation note

Updates and Hardening

This section helps the reader complete the updates and hardening portion of the Website Security Checklist with a practical, evidence-based workflow.

Use this section to make sure updates and hardening is not treated as a vague best practice. Each item should be checked, documented, and tied back to the business goal of the checklist.

Keep CMS core updated Complete this item with enough evidence for another strategist, developer, or account manager to understand what was checked and why it matters for Website Security Checklist. Critical Marketing Team Screenshot, report export, URL, test submission, or implementation note
Update plugins and themes Complete this item with enough evidence for another strategist, developer, or account manager to understand what was checked and why it matters for Website Security Checklist. Critical Marketing Team Screenshot, report export, URL, test submission, or implementation note
Remove abandoned plugins Remove or avoid remove abandoned plugins when it creates risk, confusion, wasted spend, duplicate content, tracking errors, or a poor user experience. Document the reason for the decision. High Marketing Team Screenshot, report export, URL, test submission, or implementation note
Disable unnecessary file editing Complete this item with enough evidence for another strategist, developer, or account manager to understand what was checked and why it matters for Website Security Checklist. High Marketing Team Screenshot, report export, URL, test submission, or implementation note
Use secure configuration defaults Use use secure configuration defaults only when it helps the user complete a task or understand the offer. Avoid adding elements only because they are common best practices. Recommended Marketing Team Screenshot, report export, URL, test submission, or implementation note
Monitor vulnerability notices Monitor monitor vulnerability notices on a recurring cadence and record what changed. Trends over time are usually more useful than one-time snapshots. Recommended Marketing Team Screenshot, report export, URL, test submission, or implementation note

SSL and Hosting

This section helps the reader complete the ssl and hosting portion of the Website Security Checklist with a practical, evidence-based workflow.

Use this section to make sure ssl and hosting is not treated as a vague best practice. Each item should be checked, documented, and tied back to the business goal of the checklist.

Confirm SSL certificate is active Test confirm ssl certificate is active on real devices and realistic user paths. Save screenshots, test submissions, or tool results so the team can confirm the requirement is complete. Critical Marketing Team Screenshot, report export, URL, test submission, or implementation note
Force HTTPS sitewide Complete this item with enough evidence for another strategist, developer, or account manager to understand what was checked and why it matters for Website Security Checklist. Critical Marketing Team Screenshot, report export, URL, test submission, or implementation note
Review hosting security features Review review hosting security features against the current business goal for this page or campaign. Capture the issue, evidence, recommended fix, owner, and priority so the checklist becomes an implementation plan rather than a passive review. High Marketing Team Screenshot, report export, URL, test submission, or implementation note
Use a reputable DNS provider Use use a reputable dns provider only when it helps the user complete a task or understand the offer. Avoid adding elements only because they are common best practices. High Marketing Team Screenshot, report export, URL, test submission, or implementation note
Set secure file permissions Create set secure file permissions in a way that is useful to both users and the business. The item should be visible, accurate, easy to maintain, and connected to the page or campaign goal. Recommended Marketing Team Screenshot, report export, URL, test submission, or implementation note
Monitor uptime Monitor monitor uptime on a recurring cadence and record what changed. Trends over time are usually more useful than one-time snapshots. Recommended Marketing Team Screenshot, report export, URL, test submission, or implementation note

Backups and Recovery

This section helps the reader complete the backups and recovery portion of the Website Security Checklist with a practical, evidence-based workflow.

Use this section to make sure backups and recovery is not treated as a vague best practice. Each item should be checked, documented, and tied back to the business goal of the checklist.

Run automated backups Complete this item with enough evidence for another strategist, developer, or account manager to understand what was checked and why it matters for Website Security Checklist. Critical Marketing Team Screenshot, report export, URL, test submission, or implementation note
Store backups offsite Complete this item with enough evidence for another strategist, developer, or account manager to understand what was checked and why it matters for Website Security Checklist. Critical Marketing Team Screenshot, report export, URL, test submission, or implementation note
Test restoration Test test restoration on real devices and realistic user paths. Save screenshots, test submissions, or tool results so the team can confirm the requirement is complete. High Marketing Team Screenshot, report export, URL, test submission, or implementation note
Keep pre-update backups Complete this item with enough evidence for another strategist, developer, or account manager to understand what was checked and why it matters for Website Security Checklist. High Marketing Team Screenshot, report export, URL, test submission, or implementation note
Document incident response steps Document document incident response steps in plain language before work begins. This keeps strategy, creative, development, and reporting aligned and gives future reviewers a clear reason for each decision. Recommended Marketing Team Screenshot, report export, URL, test submission, or implementation note
Confirm who can restore the site Test confirm who can restore the site on real devices and realistic user paths. Save screenshots, test submissions, or tool results so the team can confirm the requirement is complete. Recommended Marketing Team Screenshot, report export, URL, test submission, or implementation note

Spam and Malware

This section helps the reader complete the spam and malware portion of the Website Security Checklist with a practical, evidence-based workflow.

Use this section to make sure spam and malware is not treated as a vague best practice. Each item should be checked, documented, and tied back to the business goal of the checklist.

Use reputable spam protection Use use reputable spam protection only when it helps the user complete a task or understand the offer. Avoid adding elements only because they are common best practices. Critical Marketing Team Screenshot, report export, URL, test submission, or implementation note
Scan for malware Complete this item with enough evidence for another strategist, developer, or account manager to understand what was checked and why it matters for Website Security Checklist. Critical Marketing Team Screenshot, report export, URL, test submission, or implementation note
Monitor suspicious redirects Monitor monitor suspicious redirects on a recurring cadence and record what changed. Trends over time are usually more useful than one-time snapshots. High Marketing Team Screenshot, report export, URL, test submission, or implementation note
Review form abuse Review review form abuse against the current business goal for this page or campaign. Capture the issue, evidence, recommended fix, owner, and priority so the checklist becomes an implementation plan rather than a passive review. High Marketing Team Screenshot, report export, URL, test submission, or implementation note
Use CAPTCHA carefully Use use captcha carefully only when it helps the user complete a task or understand the offer. Avoid adding elements only because they are common best practices. Recommended Marketing Team Screenshot, report export, URL, test submission, or implementation note
Check search results for hacked content Review check search results for hacked content against the current business goal for this page or campaign. Capture the issue, evidence, recommended fix, owner, and priority so the checklist becomes an implementation plan rather than a passive review. Recommended Marketing Team Screenshot, report export, URL, test submission, or implementation note

Ongoing Monitoring

This section helps the reader complete the ongoing monitoring portion of the Website Security Checklist with a practical, evidence-based workflow.

Use this section to make sure ongoing monitoring is not treated as a vague best practice. Each item should be checked, documented, and tied back to the business goal of the checklist.

Enable security logging Complete this item with enough evidence for another strategist, developer, or account manager to understand what was checked and why it matters for Website Security Checklist. Critical Strategist Screenshot, report export, URL, test submission, or implementation note
Review alerts weekly Review review alerts weekly against the current business goal for this page or campaign. Capture the issue, evidence, recommended fix, owner, and priority so the checklist becomes an implementation plan rather than a passive review. Critical Strategist Screenshot, report export, URL, test submission, or implementation note
Check for unauthorized changes Review check for unauthorized changes against the current business goal for this page or campaign. Capture the issue, evidence, recommended fix, owner, and priority so the checklist becomes an implementation plan rather than a passive review. High Strategist Screenshot, report export, URL, test submission, or implementation note
Audit third-party scripts Review audit third-party scripts against the current business goal for this page or campaign. Capture the issue, evidence, recommended fix, owner, and priority so the checklist becomes an implementation plan rather than a passive review. High Strategist Screenshot, report export, URL, test submission, or implementation note
Update security documentation Document update security documentation in plain language before work begins. This keeps strategy, creative, development, and reporting aligned and gives future reviewers a clear reason for each decision. Recommended Strategist Screenshot, report export, URL, test submission, or implementation note
Schedule quarterly security reviews Review schedule quarterly security reviews against the current business goal for this page or campaign. Capture the issue, evidence, recommended fix, owner, and priority so the checklist becomes an implementation plan rather than a passive review. Recommended Strategist Screenshot, report export, URL, test submission, or implementation note

Need Help Completing This Checklist?

Need help completing this web development checklist? Request a practical audit and prioritized action plan.

Request an Audit