Website Security Checklist

Security is rarely a single fix — it’s a set of habits and configurations that need periodic review. This checklist pulls together the practical points covered across our security articles into one working list.

Access

• Every account with access to your site, hosting, or domain has two-factor authentication enabled where available
• Passwords are unique per service, not reused across accounts
• Unused or former-team-member accounts have been removed
• Access to your domain registrar and DNS provider is as tightly controlled as your hosting account

Software and plugins

• Your platform, themes, and plugins are up to date
• Plugins or themes you no longer use have been removed, not just deactivated
• You know the source of everything installed on your site

Connection security

• Your entire site loads over HTTPS with no mixed content warnings
• HTTPS is enforced, so an insecure version of a page can’t be loaded accidentally
• Your SSL/TLS certificate is valid and set to renew automatically (see SSL/TLS Security Explained)

HTTP security headers

• Key headers — HSTS, X-Content-Type-Options, a frame-ancestors or X-Frame-Options rule, and a Content-Security-Policy — are configured (see Website Security Headers Explained)

DNS and domain

• Registrar transfer lock is enabled
• Domain renewal is automatic, or reminders are in place well ahead of expiration
• DNS records have been reviewed for anything stale or unrecognized (see DNS Security Explained)

Email authentication

• SPF, DKIM, and DMARC records are configured if you send email from your domain (see SPF, DKIM and DMARC Explained)

Preparedness

• You have a recent, verified backup independent of this security review
• You have a basic plan for what to do if something is compromised, not just prevention measures

How often to run through this

A quarterly review is a reasonable default for most small to mid-sized sites, with an extra pass after any significant change — a new plugin, a migration, or a change in who has access.

The takeaway

None of these items require deep security expertise individually, but together they cover the categories responsible for the majority of real-world incidents, echoing the risk categories described in What Is OWASP and Why Does It Matter?. Treat this as a recurring habit rather than a one-time task.