2026 Website Security Checklist: comprehensive protection from basic to advanced

Website security is not a one-time configuration — it requires ongoing maintenance. According to Verizon's 2025 Data Breach Report, 43% of cyber attacks target small business websites, and over 60% of exploited vulnerabilities were known and had available patches. This means most security issues can be prevented through regular checks and hardening.

1. Infrastructure Security

Server Configuration

  • SSH root login disabled (use regular user + sudo)
  • SSH key authentication only (no passwords)
  • SSH default port changed (22 → custom)
  • Firewall configured (only necessary ports open)
  • Fail2Ban installed for brute force protection
  • Unnecessary services and ports closed
  • Automatic security updates enabled
# Quick checks
ss -tlnp                                    # Check open ports
grep -E "PermitRootLogin|Port|PasswordAuthentication" /etc/ssh/sshd_config
ufw status verbose                           # Check firewall rules

OS Hardening

  • System updated with latest security patches
  • Unnecessary system users removed
  • Proper file permissions (dirs 755, files 644)
  • SELinux or AppArmor enabled
  • Security sysctl parameters configured
  • User resource limits set

2. Web Server Security

Nginx/Apache Config

  • Server version hidden (server_tokens off)
  • HTTP methods restricted (GET/POST/HEAD only)
  • Upload size limits configured
  • Request timeout set
  • Directory listing disabled (autoindex off)
  • Secure SSL/TLS protocols configured
server {
    server_tokens off;
    
    if ($request_method !~ ^(GET|HEAD|POST)$) { return 405; }
    
    client_max_body_size 10M;
    client_body_timeout 10;
    client_header_timeout 10;
    send_timeout 10;
    autoindex off;
    
    location ~ /\. { deny all; }
    location ~ \.(env|log|sql|bak)$ { deny all; }
}
  • CSP (Content Security Policy) header configured
  • X-Frame-Options enabled (clickjacking protection)
  • X-Content-Type-Options: nosniff
  • Referrer-Policy configured
  • Permissions-Policy configured
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'" always;

3. Application Security

Code Security

  • All user input validated and sanitized
  • Parameterized queries for SQL injection prevention
  • Output encoding for XSS prevention
  • CSRF tokens on all forms
  • File upload type and size restrictions
  • Sensitive info not in URL parameters
  • Error handling doesn't expose sensitive data

Authentication

  • Password policy: 8+ chars, mixed case + numbers
  • Password storage: bcrypt/argon2
  • Login attempt limits
  • Session timeout configured
  • Two-factor authentication (2FA) available
  • Regular password rotation (sensitive systems)

CMS Security (WordPress etc.)

  • Core CMS updated to latest version
  • All plugins/themes updated
  • Unused plugins and themes removed
  • Default admin username changed (not "admin")
  • Strong passwords used
  • Login attempt limits
  • WAF rules configured

4. Data Security

Database Security

  • Database port not exposed externally
  • Least privilege principle for DB users
  • Regular database backups
  • Backup files encrypted
  • Default test databases removed
CREATE USER 'webapp'@'localhost' IDENTIFIED BY 'strong_password';
GRANT SELECT, INSERT, UPDATE, DELETE ON myapp.* TO 'webapp'@'localhost';

Data Encryption

  • HTTPS for data in transit
  • Sensitive data encrypted at rest
  • Passwords hashed with bcrypt/argon2
  • Backup files encrypted
  • API communication with API Keys or JWT

5. Operations Security

Monitoring & Logging

  • Access logs enabled
  • Error logs configured with rotation
  • Log monitoring alerts set up
  • Anomalous login detection
  • File integrity monitoring (Tripwire/AIDE)

Backup & Recovery

  • Database auto-backup daily
  • Website files auto-backup daily
  • Backups stored in multiple locations (local + object storage)
  • Backup encryption
  • Regular backup restoration testing
  • Clear disaster recovery plan

6. Third-party Security

  • 2FA enabled on all third-party services
  • API keys stored in environment variables
  • Review third-party service permissions
  • Update third-party libraries and dependencies regularly
  • Remove unnecessary third-party integrations
# Check dependency security
npm audit                          # Node.js
composer audit                     # PHP
pip-audit                          # Python

7. Recommended Security Tools

Tool Purpose Type Free?
SSL Labs SSL/TLS rating Online ✅ Free
securityheaders.com HTTP headers check Online ✅ Free
OWASP ZAP Penetration testing Local ✅ Open source
WPScan WordPress security Local ✅ Open source
Nmap Port/service scanning Local ✅ Open source
Nikto Web server scanning Local ✅ Open source
Qualys FreeScan Vulnerability scanning Online ✅ Free

8. Security Schedule

Frequency Task
📅 Daily Check backup status, basic monitoring alerts
📅 Weekly Check system updates, review error logs
📅 Monthly Audit user accounts, review security config
📅 Quarterly Full security review, update dependencies
📅 Semi-annual Penetration testing, update DR plan
📅 Annual Complete security audit, update policy docs

16IDC Takeaway

Security is an ongoing process, not a one-time project. For resource-constrained individuals and small teams, prioritize these five essentials:

  1. ✅ Enable HTTPS (Let's Encrypt — free)
  2. ✅ Configure basic security headers (CSP, X-Frame-Options)
  3. ✅ Use strong passwords + 2FA
  4. ✅ Keep systems and software updated
  5. ✅ Daily backups with regular restoration testing

These five items protect against 90%+ of common attacks. Visit 16IDC security resources for more security tools.