Website Security Checklist: 20 Things to Check Before It Is Too Late Print

Published: 15.05.2026

Most hacked websites were not attacked by a clever genius. They were taken by automatic tools that look for old software, weak passwords and open doors. A short checklist, repeated regularly, closes most of these doors.

Accounts and access

1. Use unique, long passwords for the hosting panel, the site administrator, the database and e-mail.
2. Enable two-factor authentication everywhere it is offered.
3. Remove unused accounts and give each person only the permissions they need.
4. Do not share logins. Create personal accounts so actions can be traced.
5. Use SFTP or SSH instead of plain FTP.

Software and updates

6. Update the platform, themes and plugins as soon as security fixes appear.
7. Delete what you do not use. Disabled plugins and old themes can still be attacked.
8. Download extensions only from trusted sources, never from unofficial "free premium" sites.
9. Use a current PHP version that still receives security updates.

Encryption and network

10. Install an SSL certificate and redirect all pages to HTTPS.
11. Enable HSTS once HTTPS works everywhere.
12. Use a firewall at the server or application level to block known attack patterns.
13. Limit login attempts and protect the admin address from brute force.

Files and database

14. Set correct file permissions. Files should not be writable by everyone.
15. Hide configuration files and block directory listings.
16. Change the default database prefix and user names where the platform allows.
17. Disable file editing in the administrator dashboard.

Backups and monitoring

18. Keep automatic backups in a separate place and test a restore.
19. Monitor changes and logins. Alerts about new administrators or modified files give early warning.
20. Scan for malware regularly and watch the search engine security reports for your domain.

One more: a plan for the day it happens

Write down who to call, where the backups are and how to restore them. A site that is restored in an hour causes far less damage than one that is repaired in a week.

Signs that a site has been hacked

• Unknown pages, links or redirects in search results.
• Browser warnings about a dangerous site.
• Sudden traffic drops or spikes from strange countries.
• New administrator accounts you did not create.
• Your hosting provider reports spam sent from the account.

What to do if it happens

1. Put the site in maintenance mode and change all passwords.
2. Restore a clean backup made before the infection.
3. Update everything and remove the weak component that let the attacker in.
4. Check the search console and request a review if the site was flagged.

Frequently asked questions

Is a small site a target? Yes. Attacks are automatic and do not care about the size of the site.

Is a security plugin enough? It helps, but it does not replace updates, strong passwords and backups.

Order shared hosting · Order a VPS