Website security checklist: 10 steps for small organizations

Small organizations often think hackers aren't interested in them. In reality, most attacks are automated: bots scan millions of sites looking for outdated software and weak passwords. The good news is that a few basic habits stop the vast majority of them.

The checklist

1. Use HTTPS on every page. An SSL certificate encrypts what visitors type and shows the padlock in the browser. It should renew automatically.
2. Keep software updated. Apply security updates for your website platform, plugins and server promptly. Most break-ins exploit known, already-fixed problems.
3. Remove what you don't use. Old plugins, test pages and abandoned admin accounts are open doors.
4. Give everyone their own login. No shared passwords. When someone leaves, remove their account the same day.
5. Turn on two-step verification. A code from a phone app stops almost all password attacks.
6. Use strong, unique passwords. A password manager makes this painless.
7. Back up daily — and test restores. Keep copies off the server. A backup you have never restored is only a hope.
8. Protect your forms. Spam filters, rate limits and file-type checks keep junk and malicious uploads out.
9. Secure your domain and email. Lock your domain at the registrar, keep renewal contacts current and set up SPF, DKIM and DMARC so no one can easily send email pretending to be you.
10. Watch for problems. Uptime monitoring and malware scanning mean you hear about issues before your visitors do.

If something goes wrong

Don't panic and don't delete everything. Change passwords, contact your web partner and restore from a clean backup. Then find and fix the cause so it doesn't happen again.

All websites we host and maintain include these protections. If you're not sure where your site stands, we're happy to run a quick check.