Website Security Checklist

HTTPS and SSL

• Valid SSL certificate installed and not expired
• HTTP redirects to HTTPS automatically (301 redirect)
• Strict-Transport-Security header enabled with a reasonable max-age
• No mixed content warnings (all resources loaded over HTTPS)
• Certificate chain is complete (intermediate certs included)

Security Headers

• Content-Security-Policy set — restricts script and resource sources to prevent XSS
• X-Frame-Options set to DENY or SAMEORIGIN — prevents clickjacking
• X-Content-Type-Options: nosniff — stops MIME type sniffing
• Referrer-Policy set (recommend strict-origin-when-cross-origin)
• Permissions-Policy disables unused browser features

DNS Configuration

• DNSSEC enabled on your domain for integrity verification
• A/AAAA records point to the correct servers
• MX records configured correctly for email delivery
• SPF, DKIM, and DMARC records set up for email authentication
• No open DNS resolvers exposed on your infrastructure

Authentication and Access

• All accounts use strong, unique passwords (12+ characters)
• Multi-factor authentication (MFA) enabled on all admin accounts
• No default credentials left on any service or device
• Admin panels and sensitive endpoints not publicly exposed if possible
• Session management uses secure, HttpOnly, SameSite cookies

Software and Code

• CMS, plugins, themes, and dependencies up to date
• Unused plugins, themes, and extensions removed
• Server and application version numbers hidden from response headers and error pages
• Debug mode disabled in production
• Error pages don't leak stack traces or database information

Server Configuration

• Directory listing disabled on web server
• File upload restrictions in place (allowed extensions, size limits)
• Unnecessary ports closed or firewalled
• SSH uses key-based authentication, not passwords
• Database not accessible from the public internet

Backups

• Automated backups running on a regular schedule
• Backups stored offsite or in a separate location from the server
• Restore process tested and documented
• Database dumps included in backups

Monitoring

• Uptime monitoring active with alerts for downtime
• SSL certificate expiry alerts configured (at least 30 days before)
• Server logs reviewed periodically for suspicious activity
• Failed login attempts monitored and rate-limited

How to run this checklist in practice

Treat the list as a quarterly ops ritual, not a one-time launch chore. Block 60–90 minutes: run an automated pass first, then fix what the report flags, then re-check.

1. Baseline. Run the Website Health Check on production and note SSL expiry, missing headers, and email auth gaps.
2. DNS & mail. Confirm A/AAAA and MX with DNS Lookup, then validate SPF/DKIM/DMARC with MX Validator.
3. Transport & headers. Use SSL Checker and Security Headers; fix mixed content and missing HSTS/CSP before marketing pushes traffic.
4. Exposure. Spot-check open services with Port Scanner and review robots.txt so staging paths are not accidentally crawlable.
5. Access & recovery. Verify MFA on admin accounts, confirm offsite backups restore, and test that HTTP→HTTPS redirects still return 301 after CDN changes.

Document owners for each failing item (hosting, DNS, app). Re-run the health check after fixes so you have a clear before/after for audits or agency handoffs. Pair this page with the pre-launch audit guide when shipping a new site, and the post-migration checklist after moving hosts.

Priority order when time is limited

If you only have fifteen minutes, prioritize controls that stop active abuse and data loss:

• HTTPS working end-to-end with no mixed content
• Admin MFA + no default passwords
• Offsite backup that you have actually restored once
• SPF + DMARC so attackers cannot easily spoof your domain mail
• Close unexpected open ports (databases, Redis, Docker APIs)

Headers and CSP polish matter, but a publicly reachable database or missing backups will hurt more than a missing Referrer-Policy. Fix catastrophic exposure first, then iterate on hardening.

Audit Your Site Now

Start with a free Website Health Check — one report covering SSL, DNS, email, security headers, and speed in plain English. For deeper dives on specific areas, use individual tools: SSL check, security headers, DNS lookup, or port scan.