A practical checklist covers the handful of controls that address the large majority of real-world website compromises.
The checklist
- HTTPS enabled site-wide, with auto-renewing SSL and no mixed content
- All software (CMS, plugins, themes, server OS) kept patched on a routine schedule
- Strong, unique passwords plus multi-factor authentication for every admin account
- Regular, tested backups — a backup that’s never been restored isn’t a verified backup
- A web application firewall or equivalent filtering for common attack patterns
- Rate limiting and brute-force protection on login pages
- Security headers configured (see below)
- Ongoing monitoring: uptime, SSL expiry, blacklist status, and known-vulnerability scanning
FAQ
What’s the single highest-impact item on this list?
Multi-factor authentication on admin accounts — it defeats the majority of credential-based attacks (phishing, credential stuffing, weak passwords) at once, for relatively low setup effort.