Website Security Checklist for Businesses and Institutions

Websites are attacked automatically, all day, by bots scanning for weak passwords and outdated software. Small business, school and institutional websites are targeted precisely because they are often less protected. The good news is that a few consistent practices prevent most attacks.

Use this checklist to review your website, or hand it to whoever manages it.

Access and passwords

1. Strong, unique passwords for the website admin, hosting, domain and email accounts
2. Two-factor authentication wherever it is available, especially on the admin login and domain registrar
3. Separate accounts for each person: no shared admin logins, and remove access when staff leave
4. Least privilege: give editors only the permissions they need

Software

1. Keep everything updated: CMS, themes, plugins and server software
2. Remove what you do not use: old plugins, themes and test copies of the site
3. Use trusted sources only: never install pirated themes or plugins, which often contain malware

Encryption and headers

1. SSL on every page (https), with automatic redirects from http
2. Security headers that protect visitors' browsers, such as Content-Security-Policy, Strict-Transport-Security and X-Frame-Options

Forms and data

1. Spam and bot protection on every form, such as a CAPTCHA or Turnstile check
2. Collect only what you need, and protect what you collect, in line with India's Digital Personal Data Protection Act
3. Validate uploads if visitors can upload files

Backups and monitoring

1. Automatic backups, stored off the server and tested regularly
2. Uptime and malware monitoring with alerts to someone who will act

Hosting

1. Reputable hosting with firewalls, isolation between sites and support that responds. A web application firewall and DDoS protection, such as Cloudflare, add a strong layer in front of your site

Signs your website may be hacked

• Google shows "This site may be hacked" or a red warning page
• Visitors are redirected to other sites, especially on mobile
• Unknown pages or spam links appear in search results for your domain
• New admin users you did not create
• Your hosting provider suspends the account for abuse

What to do if you are hacked

1. Do not panic, and do not delete everything
2. Change all passwords: admin, hosting, database, FTP and email
3. Restore from a clean backup taken before the attack, if you have one
4. Find and fix how attackers got in, usually an outdated plugin or weak password, or they will return
5. Update everything
6. Request a review in Google Search Console once the site is clean
7. Inform users if personal data may have been exposed

For government, banks and healthcare

Institutions that handle public services, money or health information need more than this checklist: security audits, vulnerability assessments, stricter hosting and documented incident response.

Next step

We secure, monitor and maintain websites and applications for businesses, banks and public bodies. See our cybersecurity services, our website maintenance guide, or contact us for a security review.