Website security checks for a small business

Ask your website provider who is responsible for security work after the site goes live. Request an answer for the accounts used to manage it and the software that runs it. Include the recovery process in that discussion.

Make a short work record while you talk. For each task, write down the responsible role and what evidence you can review. If responsibility is unclear, agree who will resolve it and when you will hear back.

You can use this checklist with an existing provider or while scoping web design work. Start with the systems your site actually uses. Have the provider identify the platform before anyone follows platform-specific instructions.

Protect the accounts that can change the site

List the accounts used to publish or administer the website. Include the domain and hosting accounts, plus the email account used to recover access. Ask the provider to explain what each account controls and who is authorized to use it.

CISA recommends multifactor authentication, starting with administrator accounts and staff who handle sensitive data. MFA requires more than one way to verify identity. CISA advises using the strongest available option, including phishing-resistant methods where supported.

Ask your provider which protections are enabled on your accounts. Record the answer without copying passwords or recovery codes into the work record. Have the provider identify the approved recovery process and where an authorized business owner can find its instructions.

Review who still needs access. If a former supplier remains listed, ask the current provider to confirm the account's purpose before removing it. Have them plan any required replacement access so the change does not interrupt work your business still needs.

For staff who only edit page content, ask whether they need administrator permission. Request an explanation of the available roles for your platform. Keep the approved access list with your operating instructions and revisit it when responsibilities change.

Separate connection security from maintenance

HTTPS protects communication between a website and a visitor's browser against interception and modification. Have the hosting provider confirm that the intended pages use it and that certificate maintenance is assigned.

Keep software maintenance as a separate item in the review. Ask which parts of the website require updates and which provider is responsible for them. Request an inventory based on the installed site, including any extensions that remain in use.

For a WordPress site, the official hardening guidance recommends keeping WordPress current and using trusted sources for extensions. It also explains the boundary between hosting responsibilities and the website application. Use that guidance if WordPress is your platform; ask for the equivalent official instructions for a different system.

Have the maintainer show the date and result of the last update review. Ask how unsupported components are identified and what happens when an update needs approval or testing. If an item is being deferred, record the reason and who will decide the next step.

Agree how you will be told about failed maintenance work. Ask for a contact route you can use when a page breaks after a change. Keep that route accessible to the staff member who normally notices website problems.

Ask what a recovery would include

Request a plain description of what the provider backs up. Ask them to name the website files and stored content covered by the process. Include forms and other connected tools in the conversation so their recovery arrangements can be checked separately.

For a typical WordPress site, the official backup guidance explains that a full restore needs both files and the database. A folder of files alone does not include the database. Ask the maintainer to confirm that its backup set covers both parts where they apply.

For your own site, work through the recovery questions with the provider:

• Where is the recoverable copy kept, and who can access it?
• How recent is it, and what changes would need to be repeated?
• Who can authorize and perform a restoration?
• How will the restored site be checked before customers use it?
• What information in connected services needs a separate recovery process?

Ask for a restoration demonstration in a separate test environment. Agree the scope first and keep the live site out of the exercise. Request a record of what was restored and any missing items that need follow-up.

Choose the backup schedule with the way your site changes in mind. Tell the provider which information your staff would need to recreate after a restore. Ask it to explain whether the proposed arrangement meets that need.

Check the work through a customer task

After approved maintenance, open the pages customers use and follow the normal path to the next step. Check that the service information is present and the intended contact action can be reached.

For a form check, arrange a test submission with the provider and receiving staff. Use invented details and agree how the test record will be handled. Keep the result with the maintenance record so staff can distinguish the test from a real request.

Ask who receives account warnings and service notices. Confirm that the recipient knows how to contact the provider through a known channel. Write down who covers that responsibility when the usual recipient is unavailable.

Choose an unresolved item from the review and give it an owner. For work that needs a quote, request a written scope and completion evidence before approving it.

If you cannot get a clear maintenance or recovery answer, send us the site address and the unanswered question. We will use that question to scope the work your website needs.