Website Security Checklist: SSL, Backups, and Malware Protection
A no-drama security checklist for small-business sites: HTTPS, backups you have restored once, updates, and what to do when the host says you were hacked.
Written and reviewed by Artem Palamarchuk, Founder of BLEX STUDIO.
What security does a small-business website actually need?
HTTPS, offsite backups you have restored, patched CMS/plugins, and least-privilege admin. You do not need a SOC 2 binder for a five-page site. You do need to survive a plugin exploit on a Sunday.
TLS certificate valid, auto-renewing, no mixed content
CMS, plugins, and PHP/Node runtime on supported versions
Admin accounts: unique, 2FA, no “admin/admin”
Backups daily, stored off the web root, restore tested
File upload limits; no world-writable directories
WAF / host malware scan if you run WordPress
Is WordPress unsafe?
Unmaintained WordPress is unsafe. Maintained WordPress is a known quantity. The risk is abandoned plugins, not the logo.
Do I need a pentest?
Not for a brochure. Yes before you store payments or health data. Scope to the actual risk.
What if we get hacked?
Take it offline, restore from a clean backup, rotate passwords and keys, and find how they got in. Paying a random “we will delist you” email is not the plan.
SSL from the host vs Cloudflare?
Either is fine if HTTPS is forced and mixed content is gone. Two layers that conflict is worse than one clean layer.
How much is maintenance?
A small site is often a few hundred a month. That is cheaper than an emergency rebuild.