Website Security: A Monthly Checklist

Why Is Your Website a Different Security Problem Than Your Network? 

Your internal network sits behind a firewall, and someone has to get through it. Your website is deliberately exposed to everyone on earth, which is the entire point of having one. 

Almost nobody is picking your business out of a directory and mounting a targeted attack on your brochure site. What happens is automated: software crawls the internet for known weaknesses in common web platforms, finds one, and exploits it without knowing whose site it landed on. You don’t get compromised because someone wanted your data. You get compromised because your version number matched a pattern. 

Which is oddly reassuring, because it makes the fix a maintenance problem. The same discipline that keeps your network credentials from being harvested applies here, but the surface is different, and it usually belongs to a different person. Sometimes to nobody in particular. 

What Belongs on a Website Security Checklist? 

Who Can Log In, and What Happens If Someone Guesses? 

Start with the account list. It’s usually where the surprises are. Every content management system accumulates logins: the agency that built the site, the marketing hire who posted three Blog A blog is a regularly updated website or web page, typically run by an individual or small group, that is written in an informal or conversational style. Blogs cover a wide array of topics?from personal diaries and entertainment news to professional insights and niche interests. The content on a blog usually consists of various posts or entries that appear in reverse chronological order, with the most recent post at the top. Blogs serve numerous purposes, depending on the nature and goals of the blogger. Personal blogs often function as online journals, allowing individuals to share their thoughts, experiences, and opinions. Professional or business blogs, on the other hand, can be used to establish thought leadership, engage with customers, and drive traffic to a company's website. Many bloggers leverage social media to promote their content, fostering a sense of community and interaction among readers. The interactive nature of blogs is one of their distinguishing features. Many blogs allow readers to leave comments, enabling a two-way discussion between the author and the audience. This interactivity can create a loyal readership and a strong sense of community. In addition to written content, blogs often incorporate multimedia elements such as images, videos, and links to other relevant websites or articles, enriching the reader's experience. Overall, blogs provide a versatile and dynamic platform for expressing ideas, sharing information, and connecting with a global audience. articles in 2022, the contractor who needed access “just to check something.” The bigger the company, the longer that list and the less anyone remembers approving it. Pull the account list from your site and review it. Most accounts should be gone, and several probably hold administrator rights they never needed. 

Then turn on multi-factor authentication for whoever’s left. CISA’s position is blunt: any MFA is better than no MFA, and phishing-resistant MFA is the standard to work toward. An authenticator app on your admin panel is a large improvement over nothing, though a hardware key is what CISA would actually point you at. A CMS A Content Management System (CMS) is a software application that facilitates the creation, management, and modification of digital content without requiring specialized technical knowledge. CMS platforms are widely used for building and managing websites, blogs, and other digital assets, providing users with an intuitive interface to publish content, organize information, and customize the design and functionality of their site. The core features of a CMS typically include a user-friendly editor for writing and formatting content, tools for uploading and managing media files (such as images and videos), and options for categorizing and tagging content for better organization and navigation. More advanced CMS platforms may also offer additional capabilities like version control, workflow management, multisite support, and integration with external applications and services. Popular examples of CMS platforms include WordPress, Joomla, and Drupal, each offering a range of templates, plugins, and extensions to tailor the platform to specific needs and preferences. WordPress, in particular, is renowned for its ease of use and extensive ecosystem, making it a preferred choice for both beginners and experienced developers. By streamlining the content creation and management process, a CMS empowers individuals and organizations to maintain a dynamic and interactive web presence. It eliminates the need for in-depth coding knowledge, allowing non-technical users to update and manage their content effectively. This accessibility and flexibility make CMS platforms valuable tools in the fast-paced and ever-evolving digital landscape. login is exactly the credential-phishing target it has in mind. On most sites that means adding a plugin. The next section applies. 

Is Anything Running That Nobody Updates? 

WordPress runs a large share of the web, and the core software, the part WordPress itself builds and maintains, is genuinely well looked after. The trouble is rarely there. Patchstack, a security vendor tracking vulnerabilities across the WordPress ecosystem, reported that in 2025 roughly nine in ten new vulnerabilities came from plugins and nearly all of the rest from themes. Core had six all year. Treat the exact figure the way you’d treat any vendor dataset, but the shape is right: one professionally maintained core, tens of thousands of plugins from developers of varying diligence. 

Here’s the part that catches people. Plugins and themes almost never update themselves unless somebody turned that on, one at a time. WordPress’s security team can push a fix for a critical vulnerability, and some managed hosts enable updates fleet-wide, but neither is something to count on. Minor core updates install automatically on essentially every site, major ones only on sites set up on WordPress 5.6 or later. So, core mostly looks after itself. The plugins wait for a human. 

Look at the plugin list. Anything you don’t recognize, anything the developer hasn’t updated in over a year, anything you installed to test once and left sitting there. 

Then stop before you click Update All. Plugin updates are the most common way a working site suddenly isn’t one. Two that got along fine yesterday stop getting along, or a theme leans on a function that just changed. The page that breaks is rarely the one you were looking at, and tracking it down afterwards, with no way back, turns a ten-minute job into a bad afternoon and a bill nobody wanted. 

So take a restore point before you touch anything. That’s how we run updates on the sites we manage: snapshot first, updates second, and a bad one goes back with one click. 

Underneath it all sits the language the site runs on. PHP PHP is a server-side scripting language designed for web development but also used as a general-purpose programming language. It powers many websites and content management systems, including WordPress. 8.1 and older stopped receiving security fixes at the end of 2025, and PHP PHP is a server-side scripting language designed for web development but also used as a general-purpose programming language. It powers many websites and content management systems, including WordPress. 8.2 reaches end of life on December 31, 2026. Your host can tell you which version you’re on in about thirty seconds. 

Does Every Address You Own Actually Load Over HTTPS Hypertext Transfer Protocol Secure, abbreviated as HTTPS, is an extension of HTTP used for secure communication over a computer network. HTTPS encrypts data to ensure that information exchanged between a user's browser and a website remains private and protected from unauthorized access. This protocol is particularly essential for transactions involving sensitive data, such as online banking, personal information, and other confidential communications. The use of HTTPS helps to build trust with users by providing an additional layer of security and ensuring data integrity during transmission. ? 

It’s rarely the main site that fails this one. 

It’s the old subdomain from a campaign three years ago. The staging site nobody took down. The hardcoded HTTP The Hypertext Transfer Protocol (HTTP) is a foundational technology that enables the World Wide Web to function. It is the protocol used for transmitting hypertext requests and information on the internet, allowing web browsers and servers to communicate seamlessly. HTTP defines how messages are formatted and transmitted, as well as how web servers and browsers should respond to various commands. This protocol plays a crucial role in loading web pages and transferring data, making it an integral aspect of everyday internet usage. :// link in a directory listing you don’t control. The QR code printed on last year’s trade show banner. 

Every hostname you own should serve HTTPS Hypertext Transfer Protocol Secure, abbreviated as HTTPS, is an extension of HTTP used for secure communication over a computer network. HTTPS encrypts data to ensure that information exchanged between a user's browser and a website remains private and protected from unauthorized access. This protocol is particularly essential for transactions involving sensitive data, such as online banking, personal information, and other confidential communications. The use of HTTPS helps to build trust with users by providing an additional layer of security and ensuring data integrity during transmission. , and every HTTP The Hypertext Transfer Protocol (HTTP) is a foundational technology that enables the World Wide Web to function. It is the protocol used for transmitting hypertext requests and information on the internet, allowing web browsers and servers to communicate seamlessly. HTTP defines how messages are formatted and transmitted, as well as how web servers and browsers should respond to various commands. This protocol plays a crucial role in loading web pages and transferring data, making it an integral aspect of everyday internet usage. request should redirect at the server rather than leaving it to the browser. Then the harder half: your address in print, on signage, in other people’s databases. Those still say whatever they said when somebody typed them. 

Building that inventory is the fiddly part, and the step most people skip. If you don’t know what’s out there, or who set it up, ask us and we’ll send you the list of every address still answering under your domain. 

Who Renews Your Certificate, and How? 

Certificate lifetimes are shrinking on a published schedule, and the number most people have heard is the wrong one. 

The CA/Browser Forum agreed on a phased reduction in April 2025. Since March 15, 2026, a new certificate can be issued for at most 200 days. That drops to 100 days in March 2027 and 47 in March 2029. The 47-day figure made the headlines and is still two and a half years away. The one that matters today is 200 days, shorter than a year. 

So the real question is whether anyone renews your certificate by hand. On the sites we host, renewal runs automatically, and the handful of certificates that can’t renew that way are tracked and handled before they lapse. If your site sits elsewhere, ask whoever runs it the same question. A certificate that has expired over a weekend once will do it again, and the fix is permanent. 

Can You Actually Restore From Your Backup? 

Having a backup and having a tested backup are different states. CISA’s 3-2-1 rule for small and mid-sized business is three copies of important files, two types of storage, one copy off-site. It also asks you to test the restore. NIST has said the same for a decade: test immediately after generating the backup, so you know it worked. 

Restore it somewhere harmless (a test copy of the site, not the live one) and see what you get. You’ll learn whether the database came along, whether the uploads did, and how many hours it takes. A Tuesday afternoon is a better time to find that out than an outage. There’s more on where backup responsibility actually falls if your host and your contract disagree. 

If You Take Payments, Have You Asked Your Processor One Question? 

PCI DSS The Payment Card Industry Data Security Standard (PCI DSS) is a framework established to ensure the security of credit, debit, and other payment card transactions and protect cardholders from misuse of their personal information. Developed by the Payment Card Industry Security Standards Council (PCI SSC), which was founded by major credit card companies including Visa, MasterCard, American Express, Discover, and JCB, PCI DSS provides a set of comprehensive data security requirements applicable to all entities involved in processing card payments. The standard covers a broad array of security measures, including but not limited to managing network security, protecting cardholder data, maintaining a vulnerability management program, implementing strong access control measures, regularly monitoring and testing networks, and maintaining an information security policy. By adhering to PCI DSS, organizations can significantly reduce the risk of data breaches and cyber attacks aimed at stealing payment card information. Compliance with PCI DSS is mandatory for any organization that stores, processes, or transmits payment card data, regardless of size or number of transactions. The standard is divided into six major goals and 12 requirements, creating a structured approach to securing payment environments: Build and Maintain a Secure Network and Systems Install and maintain a firewall configuration to protect cardholder data. Do not use vendor-supplied defaults for system passwords and other security parameters. Protect Cardholder Data Protect stored cardholder data. Encrypt transmission of cardholder data across open, public networks. Maintain a Vulnerability Management Program Protect all systems against malware and regularly update anti-virus software or programs. Develop and maintain secure systems and applications. Implement Strong Access Control Measures Restrict access to cardholder data by business need-to-know. Identify and authenticate access to system components. Restrict physical access to cardholder data. Regularly Monitor and Test Networks Track and monitor all access to network resources and cardholder data. Regularly test security systems and processes. Maintain an Information Security Policy Maintain a policy that addresses information security for all personnel. Adhering to PCI DSS not only helps businesses protect sensitive data and foster customer trust but also aligns them with legal and regulatory requirements concerning data protection. Thus, the PCI DSS serves as a critical component in the overall cybersecurity strategy for any organization handling payment card transactions. added two requirements covering payment pages, 6.4.3 and 11.6.1, mandatory since March 2025. One governs the scripts on the page; the other requires you to detect unauthorized changes to it. If you take payments through a hosted page or an embedded iframe from Stripe, Square or similar, you may qualify for the simplified questionnaire, which dropped both in January 2025. 

What it didn’t drop is a criterion you still attest to: that your site isn’t susceptible to script attacks affecting the payment flow. The cheapest way to satisfy it is written confirmation from your processor that their solution covers it. Get it in writing and keep it. Then check you actually qualify for that questionnaire. If you don’t, 6.4.3 and 11.6.1 are yours to implement in full. 

How Often Should You Run Through This? 

Monthly is the honest answer for the plugin and account items, because that’s roughly how fast they drift. Quarterly is fine for the rest. 

One more thing. If a checklist you find online tells you to add an X-XSS-Protection header, close it and find a different one. That header is deprecated and non-standard, and Mozilla’s documentation warns it can create the very vulnerability it claimed to prevent. Chrome pulled the filter in 2019. A checklist still recommending it is old enough that I wouldn’t trust the rest of it either. Content-Security-Policy is what replaced it. 

Should You Run This Yourself, or Hand It Over? 

Two or three of these you can do yourself this week. The rest need someone with server access and somewhere safe to test, which may or may not be you. The harder part either way is remembering to do it again in three months. 

That’s what ongoing management is for. On our website bundle plans the monthly pass is somebody’s job: updates applied with a restore point in place, certificates watched, backups tested, and an account manager who notices when something changes. 

If you’d rather see where you stand first, ask our development team to review the site and we’ll send a written list of what we found and what we’d fix first. Taking that list back to whoever built the site is a perfectly good outcome. 

Call (570) 321-7370 or use the contact form at intradatech.com. If something has already gone wrong, open a helpdesk ticket and we’ll work through it with you. 

Frequently Asked Questions About Website Security 

Isn’t my website security handled by my hosting company? 

Partly, and it depends who hosts you. A host secures the server, the network and usually the certificate. What runs on top — the CMS A Content Management System (CMS) is a software application that facilitates the creation, management, and modification of digital content without requiring specialized technical knowledge. CMS platforms are widely used for building and managing websites, blogs, and other digital assets, providing users with an intuitive interface to publish content, organize information, and customize the design and functionality of their site. The core features of a CMS typically include a user-friendly editor for writing and formatting content, tools for uploading and managing media files (such as images and videos), and options for categorizing and tagging content for better organization and navigation. More advanced CMS platforms may also offer additional capabilities like version control, workflow management, multisite support, and integration with external applications and services. Popular examples of CMS platforms include WordPress, Joomla, and Drupal, each offering a range of templates, plugins, and extensions to tailor the platform to specific needs and preferences. WordPress, in particular, is renowned for its ease of use and extensive ecosystem, making it a preferred choice for both beginners and experienced developers. By streamlining the content creation and management process, a CMS empowers individuals and organizations to maintain a dynamic and interactive web presence. It eliminates the need for in-depth coding knowledge, allowing non-technical users to update and manage their content effectively. This accessibility and flexibility make CMS platforms valuable tools in the fast-paced and ever-evolving digital landscape. , plugins, themes, user accounts and forms — is normally yours. If you’re hosted with us on a bundle or management plan, most of this list is covered on your behalf. 

We don’t store customer data. Are we really a target? 

Not being a target is the point. Attacks on small and mid-sized business sites are automated and indiscriminate. A compromised site is useful for sending spam, hosting phishing pages or quietly injecting links, none of which needs anything worth stealing. 

What does the Chrome change actually do to my site? 

Nothing, if every address you own loads over HTTPS Hypertext Transfer Protocol Secure, abbreviated as HTTPS, is an extension of HTTP used for secure communication over a computer network. HTTPS encrypts data to ensure that information exchanged between a user's browser and a website remains private and protected from unauthorized access. This protocol is particularly essential for transactions involving sensitive data, such as online banking, personal information, and other confidential communications. The use of HTTPS helps to build trust with users by providing an additional layer of security and ensuring data integrity during transmission. . If a visitor reaches an HTTP The Hypertext Transfer Protocol (HTTP) is a foundational technology that enables the World Wide Web to function. It is the protocol used for transmitting hypertext requests and information on the internet, allowing web browsers and servers to communicate seamlessly. HTTP defines how messages are formatted and transmitted, as well as how web servers and browsers should respond to various commands. This protocol plays a crucial role in loading web pages and transferring data, making it an integral aspect of everyday internet usage. address, Chrome asks whether they want to continue. They can click through, and it won’t keep asking a regular. A first-time visitor gets the question before your page. 

Should I install a security plugin? 

It can help, though it’s no substitute for the basics. A security plugin on a site with three unused admin accounts and a plugin last updated in 2021 is treating the symptom. Do the cleanup first. And when you do add one, remember it’s still a plugin: security plugins take deeper access than most, and a conflict with something already running can take the whole site down. Same rule as any other install: snapshot first, or let us do it. 

How do I know if my site has already been compromised? 

Common signs: unexpected admin accounts, pages you didn’t create, sudden ranking drops, browser warnings, or your host getting in touch about outbound spam. If you suspect it, don’t just delete what you find. The way in is usually still open.