Website Security Checklist: 30 Checks for 2026

Whether you run a marketing site, a web shop or a SaaS app, these checks cover the issues attackers exploit most often. Work through them once, then automate what you can.

HTTPS and transport

1. HTTPS on every page and subdomain, with HTTP redirecting to HTTPS.
2. TLS 1.2 and 1.3 only, with modern ciphers.
3. Certificates renewing automatically, with expiry monitoring.
4. HSTS enabled.

Security headers

5. Content Security Policy, starting in report-only mode.
6. X-Content-Type-Options: nosniff.
7. Framing protection with X-Frame-Options or frame-ancestors.
8. Referrer-Policy: strict-origin-when-cross-origin.

Authentication

9. MFA available for users and required for admins.
10. Rate limiting on login, signup and password reset.
11. Uniform error messages that do not reveal whether accounts exist.
12. Password reset tokens that are random, short-lived and single-use.
13. Secure session cookies with HttpOnly, Secure and SameSite.

Access control

14. Every server endpoint checks permissions, not just the UI.
15. Users cannot access other users' data by changing IDs.
16. Admin areas restricted by network or SSO, not exposed openly.

Input and output

17. Parameterised database queries everywhere.
18. User content escaped or sanitised before rendering.
19. Forms protected against CSRF.
20. Server-side validation on every input.

Files and exposure

21. No .env, .git, backup or debug files accessible publicly.
22. Directory listing disabled.
23. Uploads stored outside the web root, validated and served safely.

Software and dependencies

24. CMS, plugins, themes and frameworks up to date.
25. Unused plugins and software removed.
26. Dependency vulnerability alerts enabled.

DNS and email

27. No dangling DNS records pointing to deleted services.
28. SPF, DKIM and DMARC configured.

Monitoring and recovery

29. Logs for logins, admin actions and errors, with alerts on anomalies.
30. Backups taken automatically and restores tested.

Prioritising

If you can only do five things today:

Automate the checklist

Many of these checks can be automated and run continuously, across every subdomain, not just your homepage. SecurityInfinity tests headers, TLS, exposed files, outdated software, authentication weaknesses and access control, and gives a fix for each finding. Start free.

Frequently asked questions

How often should I check website security?

Continuously for automated checks, and after any significant change, such as a redesign, new plugin or new feature.

Do small websites get attacked?

Yes. Most attacks are automated and opportunistic, scanning the entire internet for known weaknesses regardless of company size.

Is a website firewall enough?

A WAF adds protection but does not fix vulnerable software or broken access control. Use it alongside this checklist.