Skip to content

Cybersecurity

Website Security Checklist for Businesses

A practical website security checklist: patching, access control, backups, monitoring and the audits that keep your site and customer data safe.

By Intelvue Engineering · Updated · 2 min read

The short answer: most website breaches exploit known, preventable weaknesses: unpatched software, weak passwords, exposed admin panels and missing backups. Work through the checklist below, automate what you can, and run a professional audit at least once a year.

1. Keep everything patched

  • Update your CMS (WordPress, Magento, Drupal), plugins and themes promptly.
  • Keep the server software, PHP version and frameworks on supported releases.
  • Subscribe to security advisories for everything you run.
  • Remove plugins and themes you no longer use.

2. Lock down access

  • Enforce strong, unique passwords and multi-factor authentication for every admin.
  • Give each person their own account with the minimum permissions they need.
  • Restrict or hide admin panels, and limit login attempts.
  • Remove accounts the day someone leaves.

3. Encrypt and harden

  • Serve the whole site over HTTPS with automatic renewal.
  • Set security headers such as Content-Security-Policy and Strict-Transport-Security.
  • Disable directory listing and remove default or test files.
  • Keep secrets out of code repositories.

4. Protect forms and inputs

  • Validate and sanitise all input on the server.
  • Add rate limiting and bot protection to forms and logins.
  • Never trust data from the browser.

5. Back up and test restores

  • Automated daily backups, stored separately from the server.
  • Test a restore regularly. An untested backup is a hope, not a plan.

6. Monitor

  • Uptime and error monitoring with alerts.
  • File integrity monitoring for unexpected changes.
  • Log logins and admin actions, and review anomalies.

7. Audit and prove it

Activity Frequency
Automated dependency and vulnerability scans Continuous
Patch review Monthly, or immediately for critical issues
Access review Quarterly
Professional security audit Yearly and after major changes
Backup restore test Quarterly

If customers or partners ask for SOC 2, ISO 27001 or GDPR evidence, the audit and documented controls become part of compliance readiness.

What to do if you are hacked

  1. Take the affected site offline or into maintenance mode.
  2. Preserve logs and evidence.
  3. Restore from a clean backup and patch the entry point.
  4. Rotate all passwords and keys.
  5. Inform affected users and regulators where required.

Get an expert review

Our cybersecurity team runs security audits, patches PHP, WordPress and Magento sites, and prepares the evidence auditors and enterprise customers ask for.

Frequently asked questions

How often should we patch our website?
Apply security patches as soon as they are released for critical vulnerabilities, and review all updates at least monthly. Unpatched CMSs and plugins are one of the most common causes of breaches.
Do small business websites get attacked?
Yes. Most attacks are automated and scan the internet for known weaknesses, regardless of company size.
What is the difference between a security scan and an audit?
A scan is automated and finds known issues quickly. An audit adds expert review of code, configuration and access, and ranks findings by real risk.

Keep reading