Website Security Checklist: 12 Essential Steps for 2026

Website breaches are no longer a big-company problem. According to IBM's Cost of a Data Breach Report 2025, the global average breach now costs $4.44 million, and in the United States the average hit a record $10.22 million. Meanwhile, the Verizon 2025 Data Breach Investigations Report found that most intrusions still start with the basics: stolen credentials (22% of breaches), exploited vulnerabilities (20%, up 34% year over year) and phishing (16%).

The good news: the majority of those entry points are closed by unglamorous, well-documented hygiene. This website security checklist walks you through 12 checks — from transport encryption and DNS to email authentication and dark-web exposure — roughly in priority order. Most sites can complete the quick wins in a single afternoon.

The checklist at a glance

#	Check	Protects against	Effort	Priority
1	Enforce HTTPS everywhere	Eavesdropping, session hijacking	Low	Critical
2	Monitor certificate expiry	Outages, browser warnings	Low	Critical
3	Harden TLS configuration	Protocol downgrade attacks	Medium	High
4	Set security headers	XSS, clickjacking	Low	High
5	Set up SPF, DKIM and DMARC	Email spoofing, phishing	Medium	Critical
6	Lock down DNS	Hijacking, rogue certificates	Medium	High
7	Patch CMS and plugins	Known-vulnerability exploits	Ongoing	Critical
8	Enforce MFA and strong passwords	Credential stuffing	Low	Critical
9	Automate and test backups	Ransomware, data loss	Medium	Critical
10	Add a WAF and rate limiting	Bots, injection, brute force	Medium	Medium
11	Monitor dark-web exposure	Leaked credential reuse	Low	Medium
12	Monitor uptime and changes	Silent failures, defacement	Low	Medium

1. Enforce HTTPS on every page

Every request — not just the login page — should be served over HTTPS. Redirect all HTTP traffic with a permanent 301 redirect, update internal links and canonicals to https://, and eliminate mixed content (images, scripts or styles still loaded over HTTP), which browsers increasingly block outright. If visitors ever see the "Your connection is not private" interstitial, you lose them before your homepage even loads.

2. Watch certificate expiry — lifetimes are shrinking fast

An expired certificate takes your site down as effectively as any attack. This item is getting harder: under the CA/Browser Forum's ballot SC-081v3, the maximum TLS certificate lifetime dropped to 200 days in March 2026, falls to 100 days in 2027 and lands at just 47 days by 2029. Manual renewal is no longer a sustainable plan.

Automate issuance with an ACME client (Let's Encrypt, or your CA's tooling) and add independent expiry monitoring. You can check your current certificate dates from a terminal:

openssl s_client -connect example.com:443 -servername example.com </dev/null | openssl x509 -noout -dates

3. Harden your TLS configuration

Having a certificate isn't the same as having good TLS. Disable TLS 1.0 and 1.1 entirely, support TLS 1.2 and 1.3 only, and drop legacy cipher suites. A weak configuration invites downgrade attacks and fails compliance scans. Our guide to achieving an A+ SSL/TLS rating covers the exact server settings.

4. Set the core security headers

Security headers are the cheapest hardening you will ever deploy — a few lines of server configuration that instruct browsers to block entire attack classes:

• Strict-Transport-Security (HSTS) — forces HTTPS on repeat visits
• Content-Security-Policy — your strongest defense against XSS
• X-Content-Type-Options: nosniff — stops MIME-type confusion
• X-Frame-Options / frame-ancestors — prevents clickjacking
• Referrer-Policy and Permissions-Policy — limit data leakage and powerful browser features

See our complete security headers guide for copy-paste nginx and Apache examples.

5. Authenticate your email: SPF, DKIM and DMARC

Your domain sends email even if your website doesn't — and attackers will happily spoof it if you let them. Google and Yahoo have required SPF, DKIM and DMARC for bulk senders since February 2024, and Microsoft applied the same requirements to Outlook in May 2025 for domains sending over 5,000 messages a day. Non-compliant mail is junked or rejected outright.

Publish an SPF record, sign with DKIM, then deploy DMARC starting at p=none to collect reports before tightening to quarantine and reject. Our step-by-step DMARC setup guide walks through the full rollout.

6. Lock down your DNS

DNS is the control plane for everything else on this list. Four checks: enable DNSSEC so responses can't be silently forged; publish a CAA record so only your chosen certificate authority can issue certificates for your domain; turn on registrar lock and MFA at your DNS provider; and prune stale subdomains pointing at decommissioned services — dangling records are a classic subdomain-takeover vector.

7. Patch your CMS, plugins and dependencies

Exploitation of known vulnerabilities was the initial entry point in 20% of breaches in the 2025 DBIR — a 34% jump in one year — and internet-facing, unpatched systems are the prime target. If you run WordPress or another CMS, the attack surface is mostly plugins and themes: enable automatic minor updates, remove anything unused, and subscribe to security advisories for the components you keep.

Stolen credentials, unpatched software and phishing together opened the door in over half of analyzed breaches. Source: Verizon DBIR 2025.

8. Turn on MFA and retire weak credentials

Credential abuse remains the single most common way in (22% of breaches). Enable multi-factor authentication on every account that can change your website: CMS admin, hosting control panel, domain registrar, DNS provider and email. Use a password manager to generate unique passwords, rename or disable default admin accounts, and remove accounts of people who no longer need access.

9. Back up as if you'll be hit tomorrow

Backups are your last line against ransomware and your first line against fat-fingered deletions. Follow the 3-2-1 rule: three copies, on two different media, one off-site — and keep at least one copy offline or immutable so an attacker who owns your server can't encrypt the backups too. A backup you haven't test-restored is a hope, not a plan: schedule a restore drill at least quarterly.

10. Put a WAF and rate limiting in front

A managed web application firewall (from your CDN, host or a service like Cloudflare) filters injection attempts, malicious bots and scanner noise before they reach your application. Add rate limiting on login, signup and API endpoints to blunt credential stuffing and brute force — the attacks feeding item 8.

11. Monitor the dark web for leaked credentials

Your credentials can leak without your site ever being touched — a third-party breach is enough, and password reuse does the rest. Monitor whether accounts on your domain appear in known breach dumps, and when they do, force a reset and confirm MFA is active. Our dark web monitoring guide explains how exposure happens and what to do about it.

12. Monitor uptime, performance and unexpected change

Availability is part of security. Uptime and performance monitoring often provides the earliest signal that something is wrong — an expired certificate, a defaced page, a crypto-mining script dragging response times down. Alerting on unexpected content or configuration changes turns a week of silent compromise into a five-minute incident.

How often should you run through this checklist?

Cadence	What to do
After every deploy	Re-check HTTPS, headers and forms on changed pages
Monthly	Review updates, user accounts, WAF logs and DMARC reports
Quarterly	Full checklist pass, backup restore drill, dependency audit
Annually	Review DNS records, access policies and incident response plan

FAQ

Is HTTPS enough to make my website secure?
No. HTTPS encrypts traffic in transit, but it does nothing against vulnerable plugins, weak admin passwords, spoofed email or leaked credentials. It's step 1 of 12 for a reason — necessary, not sufficient.

What single item gives the biggest security gain?
Combine items 7 and 8: patching known vulnerabilities and enforcing MFA. Together they directly address the two largest breach entry points measured in the 2025 DBIR — 42% of breaches combined.

Do small websites really get attacked?
Yes, constantly — just not personally. Automated scanners probe every reachable IP and domain for expired certificates, outdated plugins and open admin panels. Bots don't check your traffic stats before exploiting you.

How long does the full checklist take?
Items 1, 2, 4 and 8 are typically an afternoon of work. Email authentication and TLS hardening take a few days including DMARC monitoring. The rest are ongoing habits you automate once.

Check all of this in 60 seconds

You could verify each item by hand — or let a scanner do the first pass. The free FortifyNet scan checks your SSL/TLS setup, security headers, DNS configuration, SPF/DKIM/DMARC records, dark-web exposure and performance in about a minute, and tells you exactly which items on this checklist need attention first.

Related guides

• SSL/TLS Certificate Security: The Complete Guide to an A+ Rating
• HTTP Security Headers: The Complete 2026 Guide
• How to Set Up DMARC, Step by Step
• Dark Web Monitoring: How to Detect a Breach

Originally published on the FortifyNet blog. FortifyNet is a free 60-second website security audit — I'm the founder, happy to answer questions in the comments.