A hacked small-business site costs an average $25k in recovery, downtime, and reputation damage — yet 90% of breaches exploit basics nobody checked. Run this 20-minute audit on your site today.
Infrastructure (mostly platform-level)
- ✅ SSL certificate active AND auto-renewing
- ✅ HTTPS everywhere — no mixed-content warnings
- ✅ Security headers set (X-Content-Type-Options, X-Frame-Options)
- ✅ Daily automated backups — and you've tested a restore this quarter
- ✅ Server-side malware scanning running on schedule
Application (your responsibility)
- ✅ CMS, plugins, themes updated — every unpatched version is a known-exploit list
- ✅ Admin URL changed from defaults; strong unique passwords everywhere
- ✅ File upload forms restrict type and size server-side
- ✅ Error pages don't leak stack traces or file paths
- ✅ Unused plugins/themes/accounts deleted, not just disabled
Access and process
- ✅ Team members have individual logins, not shared admin credentials
- ✅ Former employees/contractors' access revoked
- ✅ Someone reviews access logs or audit trail monthly
The uncomfortable truth
Most checklists fail at maintenance, not setup. That's the case for platforms that automate the infrastructure half — when SSL, headers, backups, and scanning run themselves, you only have to mind the application column.