Website Security Checklist: 12 Steps to Protect Your Site
A practical website security checklist for small businesses: passwords, 2FA, updates, backups, plugin hygiene and malware warning signs. Stay safe online.
SafaHost team · · 6 min read
A good website security checklist covers four areas: who can log in, how up to date your software is, whether you can recover from a problem, and how quickly you notice something is wrong. Most attacks on small business websites are automated and target weak passwords and outdated plugins, so a few consistent habits block the majority of them.
Work through the 12 steps below once, then repeat the key checks monthly. You don't need to be a developer to do most of them.
Why small business sites get attacked
Attackers rarely pick a specific small business. Instead, automated tools scan thousands of sites for known weaknesses, such as an old plugin version or a common password, and exploit any they find.
A compromised site may be used to:
- Send spam or host phishing pages
- Redirect visitors to scam or gambling sites
- Steal form submissions or customer data
- Mine resources or attack other servers
The result can include blacklisting by search engines, warnings in browsers and damage to customer trust.
The website security checklist: access and accounts
1. Use strong, unique passwords
Every account linked to your website needs its own long password: hosting client area, CMS admin, database, SFTP, domain registrar and email. Use a password manager to generate and store them.
2. Turn on two-factor authentication (2FA)
2FA adds a second check, usually a code from an authenticator app, so a stolen password alone isn't enough. Enable it on your hosting account, registrar, email and CMS admin wherever possible. Prefer authenticator apps over SMS codes.
3. Give people only the access they need
- Create separate accounts for each person; never share logins
- Use "Editor" or "Author" roles for content staff instead of "Administrator"
- Remove accounts for former staff and agencies immediately
- Rename or avoid the default "admin" username
4. Protect the login page
Limit failed login attempts with a security plugin or your CMS's built-in options. This stops brute-force attacks that try thousands of passwords.
Keep software up to date
5. Update core, themes and plugins
Most successful attacks use vulnerabilities that already have a fix available. Update your CMS, themes and plugins promptly, especially when an update mentions security. Test major updates on a staging copy if your site is complex.
6. Practise plugin and theme hygiene
Every plugin is extra code that could contain a vulnerability.
- Install plugins only from reputable sources, such as the official WordPress.org directory or established vendors
- Check when a plugin was last updated and whether it is compatible with your version
- Delete, don't just deactivate, plugins and themes you no longer use
- Never install "nulled" (pirated) premium plugins or themes; they often contain malware
7. Use a supported PHP version
Older PHP versions stop receiving security fixes. Keep your site on a current, supported version and test compatibility before switching.
Back up and plan for recovery
8. Keep regular off-server backups
Backups are your safety net if anything else fails. Follow these rules:
- Back up both files and the database
- Store copies off the server, for example in cloud storage
- Keep several versions, so you can go back to a point before an infection
- Test a restore occasionally; an untested backup is only a hope
How often you back up depends on how often your site changes. A busy online store needs far more frequent backups than a brochure site.
9. Write a simple incident plan
Decide in advance who to call, where backups are and how to put up a maintenance page. When something goes wrong, a short written plan saves hours.
Secure the connection and the server
10. Use HTTPS everywhere
An SSL certificate encrypts data between visitors and your site. Make sure every page loads over HTTPS and that HTTP redirects automatically.
11. Use secure file transfer
Use SFTP rather than plain FTP, which sends passwords unencrypted. Set correct file permissions and avoid leaving files such as old backups or database exports in public folders.
Monitor and respond
12. Watch for signs of malware
Check your site regularly and know the warning signs.
| Warning sign | What it may mean | First action |
|---|---|---|
| Unknown admin users | Attacker created a backdoor account | Remove the account, change all passwords |
| Redirects to unfamiliar sites, especially on mobile | Injected malicious code | Scan files, compare with a clean backup |
| Spam pages in Google results for your domain | SEO spam injection | Check Search Console, clean up and request review |
| Browser or Google "dangerous site" warning | Site flagged for malware or phishing | Clean the site, then request a review |
| Unfamiliar files in upload folders | Uploaded backdoor scripts | Remove suspicious files and find the entry point |
| Sudden resource spikes or hosting warnings | Malware, spam sending or attack | Contact your host and investigate logs |
If you find an infection, change all passwords, restore from a clean backup or have the site professionally cleaned, update everything and find how the attacker got in so it doesn't happen again.
Quick monthly routine
Once the checklist is in place, spend 30 minutes each month on:
- Applying any pending updates
- Reviewing user accounts
- Checking that recent backups exist and are stored off-server
- Looking at Search Console for security issues
- Removing unused plugins, themes and files
How SafaHost supports website security
SafaHost hosting plans include free, auto-renewing Let's Encrypt SSL, SFTP access and PHP 8.3, which receives security support. Standard plans are hosted in a German (EU) data centre, and Oman Web Hosting plans run on servers in Muscat. SafaHost does not currently provide daily backups, so use a backup plugin or tool that stores copies off the server. If you notice something unusual, contact support by ticket or email.
Frequently asked questions
How often should I update my website?
Check for updates at least weekly, and apply security updates as soon as possible. A monthly full review of plugins, users and backups is a good habit.
Is a security plugin enough to protect WordPress?
A security plugin helps, but it can't replace strong passwords, 2FA, updates and backups. Treat it as one layer in this website security checklist, not the whole solution.
How do I know if my website has been hacked?
Common signs include strange redirects, unknown admin accounts, spam pages in search results, browser warnings and unexpected files. Check Google Search Console's security report too.
Where should I store my website backups?
Off the server, ideally in cloud storage or another secure location you control. Keeping backups only on the same server means losing them if the server or account is compromised.
Does SSL protect my site from hackers?
SSL encrypts data in transit, which protects visitors' information. It does not stop attacks on weak passwords or outdated plugins, so you still need the other steps.
Need a secure starting point? Choose Linux hosting with free SSL, or browse the help centre for setup and security guides.
Keep reading
Free SSL Certificate: What It Is and When You Need More
What a free SSL certificate does, how Let's Encrypt works, and when a paid OV or EV certificate is worth it. Secure your site and keep visitor trust.
How to Build a Business Website in Oman: A Practical Plan
How to build a business website in Oman: plan pages, pick a domain and hosting, choose a CMS, write Arabic and English content and get found on Google.
How to Buy a Domain Name: A Practical Guide for Oman
Learn how to buy a domain name the right way: pick an extension, check availability and trademarks, register safely and avoid renewal surprises later.