Security

Website Security Checklist (Practical, Not Paranoid)

Website security isn't about doing everything — it's about doing the right few things consistently. This checklist covers the basics that block 95% of real-world attacks.

1. Transport security

HTTPS enforced on every URL (no http:// fallback)
Valid certificate, automated renewal via ACME
HSTS header with `max-age=31536000; includeSubDomains; preload`
TLS 1.2 minimum; ideally TLS 1.3 only
Modern cipher suites; weak ciphers (RC4, 3DES) disabled

2. DNS hardening

DNSSEC enabled at registrar and nameservers
CAA record specifying which CAs may issue certificates for your domain
Domain registrar lock enabled (prevents unauthorized transfers)
Two-factor auth on the registrar account
Monitoring for unexpected DNS record changes

3. Application security

Content-Security-Policy header blocking inline scripts where possible
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Cookies marked Secure, HttpOnly, SameSite=Lax (or Strict)
Dependencies kept current; weekly vulnerability scan
Secrets in environment variables, never in source control

4. Access and authentication

2FA mandatory on all admin and CMS accounts
Unique passwords (use a password manager)
SSH key-only access for servers; password auth disabled
Principle of least privilege — admins are admins, not everyone
Audit log of admin actions retained for at least 90 days

5. Monitoring and incident response

Uptime monitoring with alerts under 1 minute
SSL expiry monitoring at 30/14/7/2 days
DNS change alerts
Documented playbook for the top 3 incident types
Off-site, tested backups (untested backup = no backup)

Recommended next steps

Diagnostic workflow

1
Verify SSL configuration
Confirm HTTPS works, the chain is complete, and there's no expiry surprise.
Check SSL guide
2
Audit DNS records
Look up A, NS, MX, TXT — make sure nothing has changed unexpectedly.
DNS Lookup
3
Confirm uptime
Make sure the site responds and the response is fast.
Uptime Check
4
Set up continuous monitoring
Alerts catch problems before users do.
Configure alerts

Frequently asked questions

What's the single most impactful security improvement?

Enable strict HTTPS with HSTS preload, automatic certificate renewal, and DNSSEC where supported. That alone eliminates a huge class of attacks.

Do small sites really need security headers?

Yes. CSP, X-Content-Type-Options, Referrer-Policy, and HSTS take minutes to set up and block real attacks regardless of traffic volume.

How often should I run security checks?

Run a full audit quarterly. Monitor SSL expiry, DNS changes, and uptime continuously — those are the things that fail silently and hurt the most.

Is my hosting provider responsible for security?

Partially. They handle physical/network security and (sometimes) OS patches. You're responsible for application code, secrets, headers, certificates, and access control.

What's the fastest way to detect a hacked site?

Continuous integrity monitoring — alerts on unexpected file changes, new outbound connections, or DNS record changes you didn't make.