Small businesses are the most targeted category in cybersecurity — and the least prepared. The Verizon Data Breach Investigations Report consistently finds that small businesses represent over 40% of breach victims. The reason isn't that attackers specifically hate small businesses. It's that small businesses are predictably under-protected against a short list of well-known issues.
This website security checklist covers those seven issues. Each one is checkable without technical expertise. Most can be fixed without hiring anyone. And the first three — SSL, DNS security, and HTTP headers — you can verify in 30 seconds with a free security scan.
Work through this list top to bottom. Anything that fails is a gap an attacker can exploit today.
SSL Certificate — validity, expiry, and configuration
What it is
An SSL/TLS certificate is the padlock in your browser's address bar. It encrypts traffic between your website and visitors, and tells browsers that your site is authentic — not a look-alike phishing page. Without a valid certificate, modern browsers display a full-page "Your connection is not secure" warning. Visitors leave. Google penalizes you in search rankings. And any data submitted through forms is exposed in transit.
Why it matters
SSL certificates expire — typically after 90 days to 1 year depending on the issuer. Many small businesses don't monitor expiry and discover the problem only when customers start complaining. An expired cert also breaks many integrations that verify certificate validity before connecting.
Beyond expiry, misconfiguration matters. A cert that doesn't cover your www. subdomain, that uses an outdated TLS version (1.0 or 1.1), or that has a weak cipher suite is a vulnerability even if the cert itself is "valid."
How to check it
- Click the padlock icon in Chrome or Firefox → "Connection is secure" → "Certificate is valid"
- Note the expiry date — anything under 30 days needs immediate renewal
- Check that
https://www.yourdomain.comandhttps://yourdomain.comboth load without warnings - Or run a free security scan on your domain — it checks validity, expiry, TLS version, and issuer automatically
Enable auto-renewal through your hosting provider (most include Let's Encrypt free). Set a calendar reminder 30 days before your current cert expires as a backup.
DNS Security Records — SPF, DKIM, and DMARC
What it is
Three DNS records protect your domain from one of the most common small business attacks — email spoofing and impersonation:
- SPF (Sender Policy Framework) — a TXT record that declares exactly which mail servers are authorized to send email from your domain. Without it, anyone can send email that appears to come from
you@yourbusiness.com. - DKIM (DomainKeys Identified Mail) — cryptographically signs outgoing email with a private key. Recipients verify the signature using a public key in your DNS. Tampered or spoofed email fails verification.
- DMARC (Domain-based Message Authentication, Reporting & Conformance) — ties SPF and DKIM together and tells receiving email servers what to do with messages that fail:
none(monitor only),quarantine(spam folder), orreject(block outright). Without DMARC, attackers can spoof your domain even if you have SPF and DKIM.
Why it matters
Email spoofing is how attackers impersonate your business to customers, suppliers, and your own employees. "Please re-send that payment to this new account" — sent from what appears to be your email address. Without DMARC, you have zero visibility into whether this is happening right now. Most small businesses don't find out until a customer calls to ask why they received a suspicious invoice from you.
How to check it
- Run a free security scan on your website — DNS email security is checked automatically
- Or manually:
dig TXT yourdomain.comto see SPF record;dig TXT _dmarc.yourdomain.comfor DMARC - Verify your DMARC policy is set to
quarantineorreject—nonemeans monitoring only, not protection
Your email provider (Google Workspace, Microsoft 365, etc.) has step-by-step SPF and DKIM setup instructions. DMARC can be added as a TXT record in your DNS registrar — start with p=quarantine and move to p=reject once you've confirmed legitimate mail passes.
Want to check items 1 and 2 right now?
Aegisly scans SSL and DNS security in under 30 seconds. Free, no signup required.Get our free Small Business Security Checklist
10 steps to protect your business — sent to your inbox in 30 seconds
HTTP Security Headers — HSTS, CSP, and X-Frame-Options
What it is
HTTP security headers are instructions your web server includes in every response, telling browsers how to behave when displaying your site. They're invisible to visitors but protect against several classes of common attacks. Most small business websites are missing at least three of the five essential headers.
- Strict-Transport-Security (HSTS) — forces browsers to always use HTTPS, even if someone types
http://. Without this, users can be downgraded to unencrypted connections mid-session. - Content-Security-Policy (CSP) — defines which scripts, images, and resources are allowed to load on your pages. Prevents cross-site scripting (XSS) attacks where malicious scripts get injected into your pages.
- X-Frame-Options — stops other websites from embedding your pages in an invisible iframe. Used to trick users into clicking things on your site without realizing it (clickjacking).
- X-Content-Type-Options — prevents browsers from guessing file types, which can be exploited to execute malicious files as scripts.
- Referrer-Policy — controls how much information is shared when users navigate away from your site.
Why it matters
Missing headers aren't theoretical — they're regularly exploited against exactly the kind of sites small businesses run: WordPress, Squarespace custom code, WooCommerce stores with third-party plugins. XSS alone accounts for a significant portion of CMS-based compromises.
How to check it
- Run a free website security check — HTTP headers are scanned automatically with pass/fail for each one
- Or manually: open Chrome DevTools → Network tab → click any request → Response Headers
- Look for
strict-transport-security,content-security-policy,x-frame-optionsin the response
If you control your server config, add headers in nginx, Apache, or your Node.js/Express app. WordPress users: plugins like "HTTP Headers" or Cloudflare's security headers feature handle this without code changes.
Software Updates — CMS, plugins, themes, and server software
What it is
Every piece of software running on or connected to your website — WordPress core, plugins, themes, your hosting control panel, server packages — has a version number. When researchers discover vulnerabilities, vendors release patches. When you don't apply those patches, you are knowingly running software with publicly documented exploits.
Why it matters
The timeline of a typical vulnerability: researcher finds it → reports to vendor → patch is released → patch release notes are public → attackers read the notes and immediately start scanning for unpatched sites. The gap between patch release and active mass exploitation is often 24–72 hours, not weeks.
WordPress sites are particularly exposed: WordPress core + 8 plugins + a theme = 10 separate update streams. A single abandoned plugin with a known CVE can compromise an otherwise well-maintained site.
How to check it
- WordPress: Dashboard → Updates — anything listed is unpatched
- Review your installed plugins and remove any that haven't been updated in over 12 months (likely abandoned)
- Check your hosting panel for server-level software alerts
- Note which plugins are still on TLS 1.0/1.1 — deprecated and vulnerable
Enable auto-updates for WordPress core minor releases. Set a monthly calendar reminder to check plugin and theme updates. Remove plugins you don't actively use — each one is an additional attack surface.
Strong Passwords and Two-Factor Authentication
What it is
Credential compromise is the single most common initial attack vector in small business breaches. Not sophisticated zero-day exploits — someone guessing, phishing, or brute-forcing a password, then walking in through the front door.
Why it matters
The specific patterns that hit small businesses hardest:
- Shared admin credentials — multiple employees using the same login for hosting, CMS, or billing. When one person leaves (or their personal email gets breached), the credential is still valid everywhere.
- Password reuse — the same password on your hosting account, your Google Workspace admin, and your payment processor. One breach on any service exposes all of them.
- No 2FA on email admin — email is the master key. Control email, reset every other password.
- Weak domain registrar passwords — attackers who compromise your domain registrar can redirect your entire website to their phishing page.
How to check it
- Audit who has admin access to hosting, CMS, domain registrar, and email — remove anyone who no longer needs it
- Check whether 2FA is enabled on your email admin, domain registrar, and hosting account
- Confirm no shared credentials remain after any employee departure in the last year
Move to a password manager (1Password or Bitwarden work well for teams). Enable two-factor authentication on your email admin and domain registrar today — those two accounts control everything else.
Already done items 1–3?
Verify your SSL, DNS, and headers pass with a free security scan on your domain.Regular Backups — and actually testing them
What it is
A current, tested backup is your recovery plan when everything else fails. Ransomware attackers count on you not having one — it's what makes the ransom worth paying. If you have a clean backup from yesterday, ransomware is an annoyance. Without one, it's an existential threat.
Why it matters
The two most common backup failures aren't missing backups — they're backups that weren't actually complete, and backups that weren't tested before a crisis. "We have backups" means nothing if you've never confirmed they restore cleanly.
- Backup frequency — daily for any site with customer data or frequent content changes; weekly minimum for static sites
- Offsite storage — backups stored only on the same server as your site don't protect against server compromise, ransomware, or hosting provider failures
- Retention period — keep at least 30 days of history. Some compromises aren't discovered for weeks; you need a clean restore point before infection
- Database backups — file backups without the database are incomplete for any CMS-based site
How to check it
- Confirm your most recent backup completed successfully and when it ran
- Verify backups are stored in a separate location from your hosting (separate S3 bucket, Google Drive, or similar)
- Do a test restore to a staging environment — at least once per quarter
Most hosting providers offer backup add-ons. For WordPress, UpdraftPlus (free) backs up files and database to cloud storage on a schedule. Schedule a quarterly 20-minute test restore — if you've never done one, do it this week.
Security Monitoring — knowing when something changes
What it is
A one-time security check tells you where you stand today. Security monitoring tells you when something changes — when your SSL cert is about to expire, when a new vulnerability is published for a plugin you're running, when your DNS records change unexpectedly, or when your site starts returning unexpected content.
Why it matters
Most small business compromises aren't discovered immediately. The average time between breach and detection for small businesses is measured in weeks. During that window, attackers can exfiltrate customer data, install persistent backdoors, use your domain for phishing, or quietly redirect traffic to malicious sites.
Configuration drift is the silent killer — a plugin update changes a header setting, a DNS record gets misconfigured during a domain transfer, your SSL cert auto-renewal fails silently. Without monitoring, you don't know until a customer tells you or Google Search Console shows a sharp traffic drop.
How to check it
- Do you have any alerting if your site goes down or your SSL certificate expires?
- Are you checking your security configuration at least monthly?
- Would you know within 24 hours if your DNS records were changed?
Run a free security scan monthly to catch configuration drift. For SSL expiry monitoring, UptimeRobot (free tier) can alert you before certs expire. Google Search Console alerts on security issues detected by Google's crawlers.
The complete website security checklist
Here's the full checklist in one place. Use this for your own review or share it with whoever manages your site:
| # | Check | Priority | How to verify |
|---|---|---|---|
| 1 | SSL cert — valid, not expiring, TLS 1.2+ | Critical | Free scan or check browser padlock |
| 2 | DNS — SPF, DKIM, DMARC on quarantine/reject | Critical | Free scan or DNS lookup |
| 3 | HTTP headers — HSTS, CSP, X-Frame-Options | Important | Free scan or browser DevTools |
| 4 | CMS, plugins, themes — all on current versions | Important | CMS dashboard → Updates |
| 5 | Passwords + 2FA on email, hosting, registrar | Important | Manual audit of admin accounts |
| 6 | Backups — daily, offsite, tested | Good Practice | Confirm last backup + test restore |
| 7 | Security monitoring — monthly checks, expiry alerts | Good Practice | Schedule monthly scan review |
Items 1, 2, and 3 can be verified automatically in 30 seconds. Run a free scan on your domain and you'll get a letter grade (A–F) with a specific breakdown of what passes and what fails — no account required.
Items 4 through 7 require a manual check, but none of them take more than an hour to audit. The total time investment to go through this entire list: a half-day. The cost of not doing it: potentially your entire customer database, your domain, your reputation, and a ransomware payment to get it back.
Run your free website security scan
Check SSL, DNS security, and HTTP headers automatically. Get an A–F grade and a plain-English fix list in 30 seconds — free, no account required.
Run your free security scan → Download the free checklist →No credit card. No signup. Results in under 30 seconds.