Website security checklist for small teams

Small teams rarely get breached by exotic attacks. They get burned by an unpatched plugin, a shared password, or a backup nobody ever tried restoring. Start with the controls that prevent those, and give every item an owner and a review date — a checkbox with no name next to it is a wish, not a control.

Accounts and ownership

• Keep the domain and hosting in organization-controlled accounts.
• Require multi-factor authentication for registrar, DNS, hosting, email, source control, CMS, analytics, and password-management accounts.
• Use individual accounts and least privilege; remove access promptly when roles change.
• Store recovery codes and emergency access in an approved, access-controlled location.
• Review third-party and agency access at least quarterly.

Software and configuration

• Maintain supported operating systems, runtimes, CMS versions, themes, and plugins.
• Apply security updates on a defined schedule and prioritize actively exploited issues.
• Remove unused packages, plugins, themes, users, services, and firewall rules.
• Separate production secrets from source code and rotate exposed credentials.
• Review security-relevant configuration after major updates.

Network and transport

• Serve every public page over HTTPS with automated renewal and expiry monitoring.
• Redirect HTTP safely and remove mixed content.
• Open only required network ports and keep databases and administration interfaces private where possible.
• Use secure remote access with keys or strong managed authentication.
• Add security headers according to the application’s needs and test them before enforcement.

Application protections

• Validate and encode untrusted input using the framework’s secure patterns.
• Protect state-changing actions against cross-site request forgery where the platform does not do so automatically.
• Rate-limit login, reset, and abuse-sensitive endpoints.
• Use secure cookie flags and short, revocable sessions for privileged access.
• Avoid revealing stack traces, secrets, or internal paths to visitors.

Backups and recovery

• Back up files, databases, configuration, DNS, and required keys or deployment definitions.
• Keep at least one copy isolated from the production account or server.
• Encrypt sensitive backups and protect deletion or retention settings.
• Run scheduled restore exercises and record recovery time and gaps.
• Keep a clean recovery path for domain, DNS, hosting, and email accounts.

Monitoring and response

• Monitor uptime, certificate expiry, application errors, suspicious authentication, changes to critical files or settings, and backup success.
• Send urgent alerts through a channel independent of the website.
• Document who declares an incident, contains harm, communicates, restores service, and preserves evidence.
• Keep provider contacts, asset inventory, and rollback procedures available during an outage.

Vendor and data review

• Know which providers process personal or sensitive data and remove integrations that are no longer needed.
• Minimize collected data and set retention rules.
• Review public storage, access links, webhooks, API keys, and abandoned subdomains.
• Confirm that monitoring and analytics do not collect secrets or unnecessary personal data.

Make the checklist operational

Review monthly for high-change systems and at least quarterly for stable sites. Repeat after migrations, ownership changes, new integrations, or security incidents. Use the backup and restore guide and HTTPS guide to turn the highest-risk items into tested routines.

Sources and further reading

• CISA: Cross-Sector Cybersecurity Performance Goals
• Ubuntu Server: Security suggestions