Website Security Checklist for 2026: 20 Essentials

A website security checklist is a prioritized list of controls that protect your site, its users and its data from the most common attacks. This 2026 version covers 20 essentials across access, software updates, infrastructure, application code and recovery, written for founders, marketing leaders and CTOs who own a website but may not have a dedicated security team.

Why does website security matter more in 2026?

Website security matters more because attackers now exploit unpatched software faster than many teams apply fixes. According to Verizon's 2026 Data Breach Investigations Report, 31% of breaches now start with software vulnerabilities, overtaking stolen credentials as the top way in.

• Verizon also found ransomware was involved in 48% of the breaches it analyzed.
• The same report says 15% of attack techniques are now bolstered by generative AI.
• The OWASP Top 10:2025 placed Software Supply Chain Failures third, reflecting compromises of dependencies, build systems and distribution infrastructure.

Small and mid-sized businesses are not too small to target. Automated scanners probe every site they can reach for known flaws, regardless of company size.

What belongs on a 2026 website security checklist?

The 20 essentials fall into five groups. Work through them in order, because the earlier groups block the most common attacks.

If you can only act on five items this month, start with these, because they close the doors attackers try first:

• Turn on MFA for every admin, hosting, registrar and email account.
• Update the CMS, plugins and themes, and delete anything unused.
• Confirm automated off-site backups exist and that someone has restored one.
• Put the site behind a CDN with a web application firewall.
• Remove former staff, old agencies and shared logins from every system.

How do you secure access and identity? (Essentials 1 to 4)

Secure access by making every login phishing-resistant and every permission necessary. Stolen and guessed credentials remain a common route into CMS dashboards and hosting panels.

1. Enforce multi-factor authentication on the CMS, hosting, DNS registrar, CDN, code repository and email, and prefer passkeys or hardware security keys over SMS codes.
2. Apply least privilege: give editors, agencies and plugins only the roles they need, and remove shared admin accounts.
3. Offboard promptly: revoke access for departing staff and vendors the same day, and review every account quarterly.
4. Store secrets in a secrets manager or environment variables, never in code, and rotate API keys after any suspected exposure.

How do you keep software and the supply chain safe? (Essentials 5 to 8)

Keep software safe by patching quickly, removing what you do not use and knowing what is in your stack. Exploited vulnerabilities are now the leading entry point, so speed matters most.

1. Patch the CMS core, plugins, themes, frameworks and server packages on a set schedule, and apply critical fixes within days, starting with flaws listed in CISA's Known Exploited Vulnerabilities catalog.
2. Remove unused plugins, themes, test pages and old staging sites that are still publicly reachable.
3. Maintain a software inventory or SBOM and run automated dependency scanning in your build pipeline.
4. Vet third-party scripts, plugins and packages before adding them, pin versions, and use Subresource Integrity for scripts loaded from CDNs.

How do you harden infrastructure and transport? (Essentials 9 to 12)

Harden infrastructure by encrypting every connection, filtering malicious traffic at the edge and closing anything that does not need to be public.

1. Serve everything over HTTPS with modern TLS, redirect HTTP, and enable HSTS once every subdomain supports HTTPS.
2. Put a web application firewall and DDoS protection in front of the site through your CDN or host.
3. Lock down admin paths and servers: restrict SSH and database access by IP or VPN, disable password SSH logins, and close unused ports.
4. Secure DNS and domains: enable registrar lock and MFA, use DNSSEC where supported, and publish SPF, DKIM and DMARC to stop spoofing of your domain.

How do you protect the application and its data? (Essentials 13 to 16)

Protect the application by validating input, controlling which scripts can run and collecting only the data you need. These controls map directly to the top OWASP risks, led by Broken Access Control and Security Misconfiguration.

1. Validate and sanitize all input, use parameterized queries, and enforce access checks on the server for every request, not just in the interface.
2. Set security headers, including a Content Security Policy, X-Content-Type-Options, Referrer-Policy and frame protections.
3. Minimize and encrypt data: collect only what forms need, encrypt sensitive data at rest, and set retention limits.
4. Protect payment pages: inventory and authorize every script on checkout pages and monitor them for tampering, as PCI DSS requirements 6.4.3 and 11.6.1 require for in-scope merchants.

For headers, MDN's Content Security Policy guide recommends a strict policy based on nonces or hashes rather than long domain allowlists. On payments, the PCI Security Standards Council notes these e-skimming requirements became mandatory on March 31, 2025, with separate eligibility rules for SAQ A merchants.

How do you monitor and recover from security incidents? (Essentials 17 to 20)

Monitor and recover by logging what matters, alerting on anomalies and proving you can restore. Prevention eventually fails somewhere, and recovery speed decides how much damage follows.

1. Centralize logs for logins, admin actions, file changes and errors, and alert on unusual activity such as new admin users.
2. Run uptime, file integrity and malware monitoring, plus regular vulnerability scans and an annual penetration test for critical apps.
3. Keep automated, encrypted, off-site backups with at least one immutable or offline copy, and test a full restore every quarter.
4. Write a short incident response plan covering who decides, who to call at your host and registrar, how to notify customers and how to roll back.

A backup you have never restored is a hope, not a plan.

Which security tasks should you schedule, and how often?

Treat security as recurring maintenance rather than a one-time project. A simple cadence keeps the checklist alive, and assigning each task a named owner keeps it from slipping when the team gets busy.

• Weekly: apply updates and review security alerts and failed login reports.
• Monthly: review user accounts, the plugin inventory and backup job status.
• Quarterly: test a full restore, review vendor access and rescan for vulnerabilities.
• Annually: run a penetration test, update the incident plan and refresh team security training.

How Advotis Agency can help

Advotis Agency's DevOps and maintenance team handles patching, monitoring, backups and hardening for websites and web apps, and our managed cloud hosting includes many of these controls by default. To review your site against this checklist, contact our team.

Frequently asked questions

Advotis Engineering Team

Written and reviewed by the Engineering Team at Advotis Agency — specialists who build and grow websites, apps and AI products for clients every day. About us