A secure website launch requires more than installing an SSL certificate. Use this practical website security checklist to verify HTTPS, administrator access, software updates, backups, malware monitoring, permissions, spam controls, and recovery procedures before visitors arrive—and then repeat the checks on a regular schedule.
Overview
Website security is an ongoing operating task, not a single setting in your hosting panel. A new site can have a valid certificate and still be exposed by an unchanged administrator password, outdated software, an untested backup, or a DNS record pointing to an old server.
The most useful approach is to divide security into four questions:
- Can visitors connect to the correct site securely?
- Can only authorized people access the site and its supporting accounts?
- Can you detect or limit unwanted changes?
- Can you restore the site if something goes wrong?
Record the result of each check, the date it was completed, and who is responsible for follow-up. A simple spreadsheet or maintenance document is enough. This creates a repeatable process for launches, redesigns, hosting changes, and monthly reviews.
If you are still choosing a platform, security responsibilities vary between a hosted website builder, traditional web hosting, and managed WordPress hosting. Compare those responsibilities alongside features and price in the Website Builder Comparison for Beginners.
What to track
1. SSL certificate and HTTPS
Confirm that the primary domain and important subdomains load over HTTPS. Check the homepage, contact forms, login pages, checkout pages, and any embedded or hosted tools that handle visitor information.
- Verify that the certificate covers the exact hostname visitors use, such as the preferred www or non-www version.
- Check the certificate's expiration or renewal status in your hosting panel, certificate manager, or platform dashboard.
- Open the site in a private browser window and confirm that the browser does not display a certificate warning.
- Look for mixed content, where a secure page still requests images, scripts, stylesheets, or other assets over HTTP.
- Confirm that HTTP requests redirect to the chosen HTTPS URL without creating a redirect loop.
Do not assume that an automatically issued certificate is also being renewed correctly. The renewal process may depend on DNS, hosting configuration, or a validation file. For setup details and common errors, see the Free SSL Certificate Guide.
2. Domain, DNS, and hosting access
List the accounts that can affect the website: domain registrar, DNS provider, hosting account, CMS administrator, email provider, analytics tools, and backup service. Remove former users and confirm that current users have only the access they need.
Review DNS records after launch or a host change. The A or AAAA record should point where you expect, CNAME records should use the intended destination, and MX records should continue to route business email correctly. Avoid deleting records simply because they look unfamiliar; document their purpose first. The DNS Records Explained guide can help you identify common record types.
3. Administrator authentication
Use unique, long passwords for the domain, hosting, CMS, and email accounts. Store them in a reputable password manager rather than in a shared document or browser note. Enable multi-factor authentication wherever the provider supports it, especially for the registrar, hosting account, administrator account, and email.
Review administrator accounts and remove unused users, old contractors, test accounts, and shared logins. Give each person an individual account so activity can be associated with the correct user. Check recovery email addresses and phone numbers as well; an outdated recovery method can prevent legitimate access or weaken account control.
4. CMS, plugins, themes, and server software
Before launch, update the CMS, themes, plugins, extensions, and hosting-panel components that your site uses. Remove software that is installed but unnecessary. Fewer active components generally mean fewer items to maintain and troubleshoot.
Take a backup before significant updates, test the site afterward, and check the homepage, forms, navigation, user login, search, and payment flow where relevant. Automatic updates can be useful, but they should fit your platform and backup process. Confirm that an update will not overwrite custom code or break a critical integration.
5. Backups and recovery
A backup is useful only if it contains what you need and can be restored. Track the backup schedule, storage location, retention settings, and the parts included: database, uploaded media, themes, plugins, configuration files, and email if your provider supports email backups.
Keep at least one backup separate from the live hosting account. Test a restoration on a staging site or another safe location rather than replacing the production site during your first test. Record how long the process takes, which credentials are required, and whether links, images, forms, and user accounts work after restoration. For a broader migration and recovery workflow, review How to Migrate a Website to a New Host Without Losing Traffic or Email.
6. Monitoring, permissions, and abuse controls
Use the monitoring options available through your host, CMS, or security tools to watch for downtime, unexpected file changes, suspicious logins, malware warnings, and unusual resource use. Treat alerts as prompts to investigate, not as proof that an incident has occurred.
Review file and directory permissions according to your platform's documented requirements. Avoid making files broadly writable just to solve a temporary upload or update error. Protect configuration files and administrative paths, and disable directory listing if it is not needed.
For forms and comments, enable spam controls and test that legitimate submissions still arrive. Check sender authentication and mail delivery settings when contact forms send email. A security control that blocks every real inquiry is not working well for the business.
7. Security headers and browser behavior
Review the security headers supported by your platform and hosting setup, such as policies that control framing, content sources, referrers, and browser features. Apply changes carefully: an overly restrictive content policy can block scripts, payment tools, fonts, or analytics. Test in a staging environment when possible, then check key pages in more than one browser.
Cadence and checkpoints
Use the following schedule as a practical starting point, then adjust it to the complexity and risk of your site.
Before every launch
- Confirm the domain and DNS records point to the intended environment.
- Verify HTTPS, redirects, forms, login pages, and checkout or booking flows.
- Remove test content, unused accounts, temporary files, and development credentials.
- Take a known-good backup and confirm how to restore it.
- Check software versions, permissions, spam protection, and essential security headers.
Monthly
- Review administrator accounts, multi-factor authentication, and recovery details.
- Confirm backups completed and perform a restoration test according to your risk level.
- Review security, uptime, malware, login, and hosting-resource alerts.
- Check certificate renewal status and test important HTTPS URLs.
- Apply pending updates after creating a backup, then test key site functions.
Quarterly or after a major change
Review the full account inventory, DNS records, third-party integrations, file permissions, and recovery instructions. Reconsider whether the hosting plan still provides suitable resources. Traffic growth, large media files, or repeated resource warnings may indicate that you should revisit your hosting configuration; the Web Hosting Resource Limits guide explains the main metrics to record.
How to interpret changes
Not every alert means the site has been compromised, and not every quiet monitoring dashboard means the site is secure. Compare changes with a timeline of deployments, plugin updates, DNS edits, campaigns, and hosting maintenance.
A sudden increase in failed logins may reflect a routine automated attack, a user who forgot a password, or a newly exposed login page. A spike in CPU or storage use may come from legitimate traffic, a backup job, oversized media, or malicious activity. Investigate the source before changing several settings at once, and preserve relevant logs where your provider allows it.
Prioritize issues by impact. A certificate warning, inaccessible recovery account, failed backup, or unknown administrator deserves immediate attention. A minor header adjustment or outdated nonessential plugin can be scheduled, but should still receive an owner and due date.
If a site has been compromised, isolate the affected account or site where possible, preserve evidence, change credentials from a trusted device, and use a known-clean backup or documented cleanup process. Avoid treating a password change alone as a complete recovery.
When to revisit
Return to this checklist before every new site launch, redesign, domain transfer, hosting migration, or major CMS update. It is also useful after changing DNS, adding a payment or marketing integration, moving email providers, or restoring a backup.
For routine maintenance, schedule a short monthly review and a deeper quarterly review. Refresh the checklist when your hosting panel, CMS, browser behavior, certificate process, backup tool, or authentication options change. Security instructions can become stale even when the website itself has not changed.
Finish each review with three concrete records:
- What was checked and when.
- What changed or failed.
- Who will fix it and by what date.
Keep the document with your site ownership and recovery information, but do not store passwords in it. Pair this security checklist with your domain portfolio records and hosting documentation so that a future administrator can identify the right accounts, renewals, DNS settings, and recovery steps without guesswork.
