Website Security Checklist 2026: Protect Your Site from Hackers, Malware & DDoS

Every 39 seconds, a cyberattack targets a website somewhere on the internet. In 2025 alone, over 30,000 websites were hacked every single day, and the majority of those victims were small and medium-sized businesses that assumed they were too small to be a target. That assumption is dangerously wrong.

Hackers do not manually pick targets. They use automated bots that scan millions of websites for known vulnerabilities — outdated plugins, weak passwords, missing security headers, misconfigured servers. If your site has a hole, it will be found. The only question is whether you have patched it before the bot arrives.

This checklist covers every layer of website security, from the basics that take five minutes to advanced measures for high-value sites. Whether you run a WordPress blog, an ecommerce store, or a custom web application, work through each section methodically. By the end, your attack surface will be dramatically smaller.

1. SSL/TLS Configuration

An SSL certificate encrypts data between your visitors' browsers and your server. Without it, login credentials, credit card numbers, and personal data travel across the internet in plain text. Google also uses HTTPS as a ranking signal, and browsers display a "Not Secure" warning on HTTP pages.

• Install a valid SSL certificate. Use a free certificate from Let's Encrypt or your hosting provider. There is no reason to run a website on HTTP in 2026.
• Force HTTPS everywhere. Add a redirect in your .htaccess file or server configuration so that all HTTP requests are automatically redirected to HTTPS. Check that internal links, images, and scripts also use HTTPS to avoid mixed-content warnings.
• Use TLS 1.3. Older versions (TLS 1.0 and 1.1) have known vulnerabilities and are deprecated by all major browsers. TLS 1.2 is acceptable, but TLS 1.3 is faster and more secure.
• Enable HSTS (HTTP Strict Transport Security). This header tells browsers to always use HTTPS for your domain, even if a user types http://. Add it to your server configuration: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload.
• Set up auto-renewal. Let's Encrypt certificates expire every 90 days. Make sure your hosting provider or a cron job handles renewal automatically so your site never goes down with an expired certificate.

2. Access Control & Authentication

Weak passwords and unprotected login pages are responsible for the majority of website breaches. Brute-force attacks try thousands of password combinations per minute, and credential stuffing uses passwords leaked from other breaches to try logging into your site.

Password Policies

• Require strong passwords. Minimum 12 characters with a mix of uppercase, lowercase, numbers, and symbols. Better yet, encourage passphrases (e.g., "correct-horse-battery-staple") which are both long and memorable.
• Use a password manager. Tools like Bitwarden, 1Password, or KeePass generate and store unique passwords for every account. No more reusing passwords across sites.
• Change default admin usernames. If your CMS creates a default "admin" account, rename it or create a new administrator account with a unique username and delete the default.

Two-Factor Authentication (2FA)

• Enable 2FA on every admin account. Use an authenticator app (Google Authenticator, Authy, or Microsoft Authenticator) rather than SMS, which is vulnerable to SIM-swapping attacks.
• Enforce 2FA for all users with elevated privileges. Editors, shop managers, and anyone who can modify content or access sensitive data should be required to use 2FA.
• Store backup codes securely. Keep them in a password manager or printed in a secure location. Losing your 2FA device without backup codes can lock you out permanently.

Login Page Hardening

• Limit login attempts. Block IP addresses after 5 failed attempts within 15 minutes. WordPress plugins like Limit Login Attempts Reloaded or Wordfence handle this automatically.
• Change the default login URL. For WordPress, the default /wp-admin and /wp-login.php are targeted by every bot on the internet. Use a plugin like WPS Hide Login to move the login page to a custom URL.
• Add CAPTCHA to login forms. Google reCAPTCHA v3 or hCaptcha adds a layer that blocks automated login attempts without annoying legitimate users.
• Restrict admin access by IP. If you and your team always work from the same locations, whitelist those IP addresses and block all other access to admin areas.

3. Software Updates & Patch Management

Outdated software is the single most exploited vulnerability on the web. When a security patch is released, hackers immediately reverse-engineer it to find the vulnerability it fixes, then scan the internet for sites that have not updated yet. The window between patch release and mass exploitation is often less than 48 hours.

• Update your CMS immediately when security patches are released. WordPress, Joomla, Drupal — all of them release critical security updates regularly. Enable auto-updates for minor and security releases.
• Update all plugins and themes. A single outdated plugin can compromise your entire site. Remove any plugins or themes you are not actively using — even deactivated plugins can be exploited.
• Keep server software current. PHP, MySQL/MariaDB, Apache/Nginx, and your operating system all need regular updates. If you are on managed hosting, your provider handles this. On unmanaged servers, set up automated security updates.
• Monitor vulnerability databases. Subscribe to security advisories for your CMS and major plugins. WPScan, Patchstack, and the NVD (National Vulnerability Database) are good sources.
• Test updates on a staging environment first. Before applying updates to your live site, test them on a staging copy to ensure nothing breaks. Most quality hosts include one-click staging.

4. Web Application Firewall (WAF)

A Web Application Firewall sits between your website and the internet, filtering malicious traffic before it reaches your server. It blocks SQL injection, cross-site scripting (XSS), file inclusion attacks, and other common exploits in real time.

• Deploy a cloud-based WAF. Services like Cloudflare, Sucuri, or your hosting provider's built-in WAF filter traffic at the network edge, before it even hits your server. This reduces server load and blocks attacks early.
• Configure custom rules. Block known malicious user agents, rate-limit suspicious IPs, and create rules specific to your application. For example, if your site does not accept file uploads from the public, block upload-related attack patterns.
• Enable bot protection. Distinguish between legitimate bots (Googlebot, Bingbot) and malicious scrapers, credential stuffers, and vulnerability scanners.
• Review WAF logs regularly. Understanding what attacks are being blocked helps you identify trends and harden your site proactively.

5. Backup & Disaster Recovery

Backups are your last line of defense. When everything else fails — when malware encrypts your database, when a bad update breaks your site, when a disgruntled employee deletes files — a recent backup lets you recover quickly.

Backup Best Practices

• Automate daily backups. Manual backups are backups you will forget to make. Set up automated daily backups of both your files and database.
• Follow the 3-2-1 rule. Keep 3 copies of your data, on 2 different storage types, with 1 copy stored off-site (a different data center or cloud storage like AWS S3 or Google Cloud Storage).
• Test your backups regularly. A backup you have never restored is a backup you cannot trust. Schedule quarterly restore tests to verify your backups actually work.
• Keep at least 30 days of backup history. Some infections or compromises go undetected for weeks. Having 30 days of daily backups gives you a clean restoration point even if the breach happened two weeks ago.
• Encrypt your backups. Backups contain your entire site, including database credentials and customer data. Store them encrypted, especially off-site copies.

Recovery Plan

• Document your recovery procedure. Write down the exact steps to restore your site from a backup, including who has access to the backup storage, which credentials are needed, and the expected recovery time.
• Define your RTO and RPO. Recovery Time Objective (how fast you need to recover) and Recovery Point Objective (how much data loss is acceptable). For most small businesses, an RTO of 1–4 hours and an RPO of 24 hours (daily backups) is reasonable.
• Have a communication plan. Know who to notify (customers, team, hosting provider) and have template messages ready so you are not writing crisis communications under pressure.

6. DDoS Protection

A Distributed Denial of Service attack overwhelms your server with traffic from thousands of sources simultaneously, making your site unreachable. DDoS attacks are cheap to launch (as little as $10 on the dark web) and can cost businesses thousands per hour in lost revenue.

• Use a CDN with DDoS mitigation. Cloudflare, AWS CloudFront, and similar services absorb and filter attack traffic across their global networks, keeping your origin server protected.
• Enable rate limiting. Restrict the number of requests a single IP can make within a given timeframe. This stops simple volumetric attacks and aggressive scrapers.
• Hide your origin server IP. If attackers know your server's real IP address, they can bypass your CDN and attack directly. Use your CDN's proxy features and never expose your origin IP in DNS records, emails, or API responses.
• Have a DDoS response plan. Know how to activate "Under Attack" mode on your CDN, contact your hosting provider's abuse team, and communicate with customers during an attack.
• Choose a host with built-in DDoS protection. Modern cloud hosting providers include network-level DDoS mitigation that filters out most attacks before they affect your site.

7. Malware Scanning & Monitoring

Malware can hide in your site for weeks or months, stealing data, sending spam, or redirecting visitors to malicious sites. Regular scanning catches infections early before they cause serious damage.

• Run daily automated malware scans. Tools like Sucuri SiteCheck, Wordfence (for WordPress), or ImunifyAV scan your files and database for known malware signatures, backdoors, and suspicious code.
• Monitor file integrity. Track changes to core files, plugins, and themes. If a file that should not change suddenly has new code injected, you have been compromised. Tools like OSSEC, Tripwire, or WordPress-specific plugins handle this.
• Check Google Search Console regularly. Google notifies you if it detects malware or hacked content on your site. Set up email alerts so you are notified immediately.
• Scan for blacklisting. Use tools like Google Safe Browsing, VirusTotal, or Sucuri SiteCheck to verify your site has not been blacklisted by search engines, browsers, or antivirus software.
• Monitor uptime. Use an external monitoring service (UptimeRobot, Pingdom, or Better Uptime) to alert you immediately when your site goes down. Unexpected downtime can indicate an attack or compromise.

8. Security Headers

HTTP security headers instruct browsers on how to handle your site's content, preventing many common attacks. These are easy to add and dramatically improve your security posture.

You can test your security headers using tools like SecurityHeaders.com or Mozilla Observatory. Aim for an A or A+ grade. Most headers can be added via your .htaccess file, Nginx configuration, or through your hosting control panel.

9. Database Security

Your database stores everything — user accounts, orders, content, configurations. A database breach is often the most damaging type of attack because it exposes all your data at once.

• Change the default database prefix. WordPress uses wp_ by default, which makes SQL injection attacks easier. Change it during installation or use a plugin to change it on an existing site.
• Use a unique database user per site. Never use the root database account for your website. Create a dedicated user with only the permissions the site needs (SELECT, INSERT, UPDATE, DELETE on its own database).
• Restrict remote database access. Unless you specifically need remote database connections, block them. Only allow connections from localhost or specific trusted IPs.
• Sanitize all user inputs. Use prepared statements (parameterized queries) in your code to prevent SQL injection. Never concatenate user input directly into SQL queries.
• Encrypt sensitive data at rest. Passwords should be hashed with bcrypt or Argon2. Other sensitive data (payment info, personal details) should be encrypted in the database using AES-256.

10. File & Server Security

File Permissions

• Set correct file permissions. On Linux servers, directories should be 755 and files should be 644. Configuration files containing credentials (like wp-config.php) should be 600 or 640.
• Disable directory listing. Add Options -Indexes to your .htaccess file to prevent visitors from browsing your directory structure.
• Protect sensitive files. Block direct access to configuration files, backup files, and log files. Add rules to your .htaccess or Nginx configuration to deny access to files like .env, .git, wp-config.php, and *.sql.

Server Configuration

• Disable PHP execution in upload directories. Attackers often upload PHP backdoors disguised as images. Block PHP execution in /uploads/, /wp-content/uploads/, and similar directories.
• Remove server version information. Disable the Server and X-Powered-By headers that reveal your web server software and version. This makes it harder for attackers to target version-specific vulnerabilities.
• Use SSH keys instead of passwords. If you have server access, use SSH key authentication and disable password authentication entirely. This eliminates brute-force attacks against SSH.
• Close unused ports. Use a firewall (UFW, iptables, or your cloud provider's security groups) to block all ports except those your site actually needs (typically 80, 443, and your SSH port).

11. Email Security

Your domain's email security affects your website security directly. Phishing emails sent from spoofed versions of your domain can trick customers and damage your reputation.

• Set up SPF records. Specify which mail servers are authorized to send email for your domain. This prevents spammers from sending emails that appear to come from your address.
• Enable DKIM signing. DKIM adds a digital signature to your outgoing emails, allowing recipients to verify the email has not been tampered with in transit.
• Implement DMARC. DMARC tells receiving mail servers what to do with emails that fail SPF and DKIM checks (reject, quarantine, or report). Start with p=none to monitor, then move to p=quarantine or p=reject.
• Train your team on phishing. Technical controls are important, but human error remains the leading cause of breaches. Teach your team to verify sender addresses, avoid clicking suspicious links, and report phishing attempts.

12. Monitoring & Incident Response

Security is not a one-time setup. You need ongoing monitoring and a plan for when something goes wrong despite your best efforts.

Continuous Monitoring

• Set up real-time alerts. Configure notifications for failed login attempts, file changes, new user accounts, and plugin installations. Many WAF and security plugins offer built-in alerting.
• Review access logs weekly. Look for unusual patterns: spikes in 404 errors (directory scanning), repeated POST requests to login pages (brute force), or requests for files that should not exist (probing for vulnerabilities).
• Monitor SSL certificate expiration. Even with auto-renewal, monitor your certificate status. An expired certificate breaks your site and destroys visitor trust.
• Track third-party integrations. Payment gateways, analytics scripts, chat widgets, and other third-party services can introduce vulnerabilities. Monitor for changes and remove any you no longer use.

Incident Response Plan

1. Detect: Automated monitoring alerts you to suspicious activity.
2. Contain: Isolate the affected system. Take the site offline if necessary to prevent further damage.
3. Investigate: Identify how the breach occurred, what was accessed, and what data was exposed.
4. Remediate: Remove the malware, patch the vulnerability, and restore from a clean backup.
5. Notify: If customer data was exposed, notify affected users and relevant authorities (GDPR requires notification within 72 hours).
6. Review: Document what happened and update your security measures to prevent a recurrence.

"The question is not whether your website will be attacked, but whether you will be prepared when it happens. A comprehensive security checklist is the difference between a minor incident and a business-ending breach."

Quick-Reference Checklist Summary

Frequently Asked Questions

How often should I audit my website security?

Perform a comprehensive security audit at least quarterly. However, certain tasks should be ongoing: malware scanning daily, software updates weekly, and access log reviews weekly. After any significant change to your site (new plugin, server migration, design overhaul), run a full audit immediately.

Is shared hosting secure enough for my business?

Shared hosting can be secure if your provider implements proper account isolation (CloudLinux, CageFS). However, you share a server with other websites, and a vulnerability in a neighboring site can sometimes affect yours. For businesses handling sensitive data, cloud hosting or VPS provides better isolation and security controls.

Do I need a paid security plugin for WordPress?

Free plugins like Wordfence (free tier) and Sucuri Security provide solid baseline protection including firewall rules, malware scanning, and login hardening. Paid versions add features like real-time firewall rule updates, priority malware removal, and advanced scanning. For most small businesses, the free tier plus good hosting security is sufficient.

What should I do if I discover my site has been hacked?

Do not panic. Take the site offline to prevent further damage, change all passwords (hosting, CMS, database, FTP, email), scan for malware, restore from a clean backup if available, and patch the vulnerability that allowed the breach. See our detailed guide on website hack recovery.

How can I check if my website is secure?

Use free tools: SSL Labs (ssl-labs.com) tests your SSL configuration, SecurityHeaders.com checks your HTTP headers, Google Safe Browsing verifies you are not blacklisted, and Sucuri SiteCheck scans for malware. Run all four and address any issues found.