TL;DR: This checklist covers the 20 most impactful security checks for any website — from HTTPS and email authentication to exposed files and DNS hardening. Work through it in order and you will catch the issues that compromise most small-business sites. Run a free Kalenfy scan to automate the technical checks and get a downloadable report.
How to use this checklist
Each item below is marked with a priority tier:
- Critical — fix immediately; exploitable without skill
- High — fix this week; meaningful risk if left open
- Medium — fix this month; good hygiene, lower immediate risk
You don't need to fix everything in one sitting. Start with Critical, then work down. Many checks can be done with free tools or your hosting panel in minutes.
HTTPS & encryption
| Check | Priority | How to verify |
|---|---|---|
| SSL/TLS certificate is valid and not expiring within 30 days | Critical | Browser padlock → Certificate details |
| All pages redirect HTTP → HTTPS automatically | Critical | Visit http://yourdomain.com — should redirect |
| No mixed content (HTTP resources on an HTTPS page) | High | DevTools Console for "Mixed Content" warnings |
| TLS 1.0 and 1.1 are disabled (TLS 1.2+ only) | High | SSL Labs server test |
| HSTS header present with a long max-age (≥1 year) | Medium | HSTS guide |
Security headers
| Header | Priority | What it does |
|---|---|---|
| Content-Security-Policy (CSP) | High | Blocks XSS and data injection |
| X-Frame-Options or CSP frame-ancestors | High | Prevents clickjacking |
| X-Content-Type-Options: nosniff | Medium | Stops MIME-type sniffing |
| Referrer-Policy | Medium | Controls what URL data is shared with third parties |
| Permissions-Policy | Medium | Restricts browser features (camera, geolocation) |
Check all five in one go with the Kalenfy scanner or read the full header guide.
Email authentication (anti-spoofing)
Without these three DNS records, anyone can send email pretending to be your domain:
| Record | Priority | What it prevents |
|---|---|---|
SPF record exists and has a valid -all or ~all qualifier | Critical | Unauthorised senders from your domain |
| DKIM key published in DNS and email is signed | Critical | Forged email content |
DMARC record exists with at least p=quarantine | Critical | Brand impersonation / business email compromise |
DMARC reporting (rua) configured to monitor failures | High | Visibility into spoofing attempts |
| BIMI record (optional, logo in inbox) | Medium | Brand trust at send |
New to SPF/DKIM/DMARC? Start with our comparison guide.
DNS & domain hardening
| Check | Priority | Notes |
|---|---|---|
| DNSSEC enabled and validating | High | Prevents DNS cache poisoning |
| CAA record limits which CAs can issue SSL certs for your domain | High | Stops rogue certificate issuance |
| No dangling DNS records pointing to unclaimed cloud resources | High | Subdomain takeover risk |
Parked/unused domains have SPF -all + DMARC p=reject | High | Attackers target inactive domains |
| Domain registrar has 2FA enabled | Critical | Prevents domain hijacking |
Exposed files & secrets
| Check | Priority | How to test |
|---|---|---|
.env file not publicly accessible | Critical | Visit https://yourdomain.com/.env — must return 403/404 |
.git directory not browsable | Critical | Visit https://yourdomain.com/.git/HEAD — must return 403/404 |
| No live API keys in public HTML or JavaScript | Critical | View source and search for "sk_live", "AKIA", "AIza" |
| Error pages don't reveal stack traces, file paths or framework versions | High | Trigger a 404 and 500 error, inspect the response |
| Directory listing disabled on web server | High | Visit a directory URL — should not list files |
Cookie security
| Flag | Priority | What it does |
|---|---|---|
Secure flag on all cookies | High | Blocks cookies over HTTP |
HttpOnly flag on session cookies | Critical | Prevents JavaScript from reading the cookie (XSS protection) |
SameSite=Lax or Strict on session cookies | High | Prevents CSRF attacks |
Software & updates
- [Critical] CMS core (WordPress, Drupal, etc.) is on the latest stable version.
- [Critical] All plugins and themes are up to date and actively maintained.
- [High] PHP / Node / runtime version is within security support.
- [High] Deactivated plugins are removed, not just disabled — they still execute.
- [Medium] The server software version is not advertised in response headers.
Access & authentication
- [Critical] Admin accounts use strong, unique passwords (password manager + 16+ chars).
- [Critical] Two-factor authentication is enabled on the CMS admin and hosting panel.
- [High] Default admin usernames ("admin", "administrator") have been changed.
- [High] Login attempts are rate-limited or behind a CAPTCHA.
- [Medium] Unused admin accounts are removed.
Backups & incident readiness
- [Critical] Automated daily backups run and are stored off-site (not on the same server).
- [High] You can restore from backup in under one hour — test it.
- [High] You know which registrar, host and DNS provider hold your domain/site.
- [Medium] A basic incident response plan exists: who to call, where to revoke credentials.
Quick-start: the three fixes that matter most
If you only have 30 minutes, focus here:
- Set up DMARC at
p=quarantine— most domains are spoofable today because this record is missing. Takes 5 minutes. DMARC setup guide → - Add missing security headers — CSP, X-Frame-Options and X-Content-Type-Options can be set in your server config or CDN (Cloudflare) in minutes. Header guide →
- Check
/.envand/.gitare blocked — leaked credentials are the fastest path to a full site compromise. Run the Kalenfy scan →
FAQ
How often should I run a security checklist?
At minimum, once per quarter and after any major change (new plugin, new team member, infrastructure migration). Automated scans like Kalenfy can run continuously so you don't need to remember.
Do I need a penetration test on top of this checklist?
This checklist covers passive, public-facing checks — it doesn't require authentication or intrusive testing. A penetration test goes deeper (authenticated, business logic, internal network) and is warranted when you handle sensitive data or have compliance requirements. The passive scan is always a sensible first step before commissioning a pentest.
My site is on a managed platform (Shopify, Squarespace) — do I still need this?
The platform handles server-side hardening, but you still own the email authentication (SPF/DKIM/DMARC), domain configuration (DNSSEC, CAA), API key safety and admin account security. All the DNS and email checks in this list still apply.
How do I check all of these at once?
The Kalenfy scanner automates the HTTPS, security headers, cookie flags, email authentication, DNS and exposed-file checks from this list. It generates a PDF report you can work through systematically — free, no account required.