Website Security Checklist: Backups, SSL, Malware and Updates

Website security is a set of layers that reduce the chance and impact of a failure. SSL does not make an outdated application secure. A malware scanner does not replace access control. A backup does not help if it is incomplete, stored with the compromised site, or has never been restored.

A practical security plan protects confidentiality, integrity, and availability: only authorized people can reach sensitive data, the website and records have not been changed improperly, and the business can restore service when something goes wrong.

1. Maintain backups you can actually restore

Back up the database and the files needed to rebuild the site. For WordPress, those are separate parts: content and many settings live in the database, while themes, plugins, uploads, and configuration are files. The official WordPress backup guidance explains why both are needed.

Before each material production change, create a targeted backup of the affected files, data, and settings with exact rollback steps. The WordPress maintenance checklist shows how to make this part of routine releases.

2. Use HTTPS correctly

A valid TLS certificate encrypts traffic between a visitor and the website and helps authenticate the domain. Redirect HTTP to HTTPS, remove mixed-content requests, renew the certificate before expiration, and monitor hostname coverage.

HTTPS does not stop stolen administrator passwords, vulnerable plugins, malicious code, insecure file permissions, or business-email compromise. Treat it as one required transport-security control, not a security certificate for the whole application.

3. Keep the application stack supported and updated

Maintain the content management system, themes, plugins, runtime, server software, and dependencies. Remove software that is genuinely unused after confirming it is not required. Obtain code from trusted sources and review support status before relying on an extension.

WordPress's current hardening guidance emphasizes supported updates, trusted sources, backups, secure access, logging, and monitoring. Back up before updates, apply them in a controlled scope, and test the live result immediately.

4. Protect administrator and hosting access

• Use unique accounts instead of a shared administrator login.
• Grant the minimum role required for each job.
• Use strong unique passwords and a password manager.
• Enable multifactor authentication wherever supported.
• Protect hosting, registrar, DNS, email, CDN, analytics, and backup accounts—not only WordPress.
• Remove access when employment or vendor relationships end.
• Keep recovery methods and emergency contacts current.

CISA's Secure Our World guidance highlights strong passwords, multifactor authentication, software updates, and phishing awareness. These practices matter because a website can be compromised through the accounts around it.

5. Reduce attack surface

Limit administrator accounts, unused software, public services, exposed credentials, and unnecessary integrations. Use appropriate file ownership and permissions. Disable editing or endpoints only when you understand the operational effect; aggressive rules can break forms, updates, APIs, or other legitimate functions.

Store secrets outside source-controlled public files and rotate them when exposure is suspected. Never place private keys, API secrets, database passwords, or backup archives in a public download path.

6. Monitor for malware and unexpected change

Use reputable host, edge, or application monitoring appropriate to the site. Watch for unexpected administrators, modified files, injected redirects, spam pages, unusual outbound mail, traffic spikes, blocked update checks, search warnings, and changes to DNS or analytics.

A clean scan is evidence at one point in time. It cannot prove no compromise exists. Preserve logs and timestamps long enough to investigate, and send alerts to an owner who knows what to do.

7. Secure forms, integrations, and data handling

Validate and sanitize input, use anti-spam controls appropriate to the form, protect file uploads, minimize collected data, and restrict submission access. Confirm where notifications and entries are stored and how long they remain. Test mail and CRM handoffs after updates.

Use scoped API credentials, verify webhook signatures where the provider supports them, and log failures without storing secrets. A public contact form, checkout, or API endpoint is part of the application's security boundary.

8. Prepare a malware and incident response plan

1. Preserve evidence and record the discovery time.
2. Limit access or isolate the affected scope without destroying evidence.
3. Change compromised credentials from a known-clean device.
4. Identify the initial access and persistence mechanism.
5. Restore from a verified clean point or rebuild affected components.
6. Patch the cause before reopening the same path.
7. Test pages, forms, integrations, email, SEO, users, and logs.
8. Follow applicable legal, contractual, insurance, and notification obligations.

Do not restore blindly from the newest backup; it may already contain the compromise. Do not declare the incident closed just because visible spam disappeared.

9. Protect domain, DNS, and availability

Use registrar lock and multifactor authentication where supported, restrict DNS access, document records, and monitor unexpected changes. Maintain domain and certificate renewals. Review hosting limits, resource alerts, uptime, and denial-of-service protections appropriate to the business risk.

Website mistakes can also look like security failures to customers. Use the guide to customer-facing website problems and the small-business website systems guide to widen the test plan.

Website security questions

Does SSL mean a website is secure?

No. HTTPS protects data in transit between the browser and server. Application updates, accounts, code, hosting, backups, monitoring, and data handling require separate controls.

How often should a website be backed up?

Base frequency on how much new content, form data, orders, or settings the business can afford to lose. Verify jobs regularly and test restoration.

Can a security plugin replace professional maintenance?

No single plugin covers the hosting account, DNS, backups, user behavior, email, external integrations, incident response, and every application risk. Tools should support a documented process.