You don't need to be a security expert to avoid the most common — and most damaging — website mistakes. Most small-business hacks come down to a handful of gaps. Here's the practical checklist every site should meet in 2026.
The essentials
- HTTPS everywhere — a valid SSL certificate on every page, with HTTP redirecting to HTTPS. (Non-negotiable, and it's free.)
- Everything up to date — your CMS, plugins, themes and libraries. Outdated software is the #1 way sites get hacked.
- Strong, unique admin passwords plus two-factor authentication on every admin account.
- Automatic backups — stored off-server, tested, so you can restore fast if something goes wrong.
- Limited access — only give people the access level they actually need, and remove old accounts.
The next layer
- Security headers — HSTS, X-Content-Type-Options, X-Frame-Options and a content-security policy.
- Input validation — protects against injection and cross-site scripting (XSS) attacks.
- Spam & bot protection on forms and logins (rate limiting, a challenge on repeated attempts).
- Dependency scanning — know when a library you use has a published vulnerability, and patch it.
- A firewall / WAF in front of the site to block common attacks.
Why it matters more than you think
A hacked site isn't just downtime — it can mean stolen customer data, a Google "this site may be harmful" warning, lost rankings and lost trust. The cost of prevention is a fraction of the cost of a breach.
Not sure where you stand?
Most sites pass some of this list and quietly fail the rest. I offer security hardening — reviewing your site against this checklist, fixing the gaps, and setting up sensible protection. Get in touch for a review.