Website Security Checklist 2026

The certificate is valid, unexpired and matches your domain. Check it with the SSL Labs server test.

TLS 1.0 and 1.1 were formally deprecated in 2021 (RFC 8996), so turn them off. Prefer TLS 1.3.

Redirect all HTTP traffic to HTTPS automatically with a 301.

Install the intermediate certificates and configure them correctly.

Use a current server profile and disable weak ciphers such as RC4, DES and 3DES.

Protects past sessions even if the private key leaks. TLS 1.3 always provides it.

Certificate lifetimes keep shrinking. Under the CA/Browser Forum Baseline Requirements, public certificates may be valid for at most 200 days since 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. Renew through ACME and get an alert when a renewal fails.

No HTTP resources loaded on HTTPS pages.

A CAA record (RFC 8659) names the certificate authorities allowed to issue for your domain.

Forces HTTPS connections. Send max-age=31536000 (one year) or more, plus includeSubDomains once every subdomain runs on HTTPS.

The preload list needs max-age of at least one year, includeSubDomains and preload. Removal takes months, so submit only when you can hold HTTPS on all subdomains for good (hstspreload.org).

Use a strict policy: a fresh random nonce per response (or hashes for static pages), 'strict-dynamic', object-src 'none' and base-uri 'none'. Test in report-only mode first (web.dev/articles/strict-csp).

Set the CSP directive frame-ancestors to 'none' or 'self'. X-Frame-Options DENY or SAMEORIGIN stays as a fallback for older browsers.

Prevents MIME type sniffing.

Current browsers ignore the old XSS filter, and in older ones it could open new holes. Your Content-Security-Policy does this job.

Controls the referrer sent with requests. strict-origin-when-cross-origin is a sensible default.

Replaces the old Feature-Policy header. Switch off camera, microphone, geolocation and other browser features your site does not use.

Prevent caching of sensitive pages (no-store for private content).

Do not reveal server software versions (Apache, nginx and so on).

Get consent before you store or read non-essential data on the visitor's device (in Germany: § 25 TDDDG). No pre-ticked boxes.

Must include all required information about data processing.

Required in Germany under § 5 DDG: name, address, contact details.

Required with hosting providers, analytics tools, email services.

Users must be able to request their stored data.

Process for users to request data deletion.

Users can export their data in a machine-readable format.

Inform users how form data will be processed.

List all external services: analytics, fonts, CDNs and so on. Host fonts yourself where you can.

Define how long each type of data is stored, and delete it on schedule.

Cloudflare, Sucuri, or a server-based WAF to filter malicious traffic.

Automated scanning at least weekly for suspicious files.

Keep WordPress, Joomla, Drupal and their plugins on current versions.

Inactive code can still contain vulnerabilities.

Get an alert when core files change without a planned update.

Use parameterized queries and validate input on the server. Injection is A05 in the OWASP Top 10:2025.

Encode all output for its context and sanitize user input. A strict CSP adds a second layer.

Combine SameSite cookies with unique tokens on forms and state-changing requests.

Keep lockfiles, run npm audit or an equivalent in your build, and load third-party scripts with Subresource Integrity where possible. OWASP lists Software Supply Chain Failures as A03:2025.

CDN or hosting provider with DDoS mitigation, plus rate limits on login and form endpoints.

Back up both the database and the files automatically.

3 copies, 2 different media types, 1 off-site location.

On a different server or cloud account. Keep at least one copy that someone with access to your site cannot overwrite or delete (immutable or offline).

Protect backup files with strong encryption (AES-256).

Run a test restore every quarter to confirm the backups work.

Decide how long you keep daily, weekly and monthly backups.

Step-by-step procedure for complete site restoration.

The maximum downtime you can accept after a failure.

At least 15 characters when the password is the only factor, at least 8 with multi-factor. Allow long passphrases, check against a list of breached passwords, impose no composition rules and no scheduled changes. Force a change after a compromise.

Prefer passkeys or hardware security keys. An authenticator app (TOTP) is the minimum. SMS codes protect least.

Passkeys (FIDO2/WebAuthn) resist phishing. NIST SP 800-63B-4 allows syncable authenticators up to assurance level AAL2, but not at AAL3.

Rate-limit sign-in attempts, lock accounts after repeated failures or show a CAPTCHA.

Put /admin, /wp-admin and similar behind an IP allow-list, VPN or access gateway. A renamed URL alone is not protection.

Each user gets only the permissions they need. Broken Access Control is A01 in the OWASP Top 10:2025.

Secure, HttpOnly and SameSite session cookies, a timeout, and a new session ID after login.

OWASP recommends Argon2id first. Use bcrypt only in legacy systems. Never store plain text or fast hashes such as MD5 or SHA-1.

Remove inactive accounts and review permissions quarterly.

Time-limited single-use tokens, no security questions, confirmation by email.

Apply security patches regularly.

Apache, nginx or IIS on a supported version.

Runtimes that no longer get security fixes are a risk. Check the end-of-life date of your version.

Only required ports open (80, 443, SSH).

Disable password login, use SSH keys, add fail2ban or an equivalent.

Directories 755, files 644, config files 600.

Prevent browsing directory contents.

MySQL or PostgreSQL reachable only from localhost or a private network.

Block access to configuration files via the web.

Get an alert when the site goes down (UptimeRobot, Pingdom).

Log sign-ins, failed attempts, file changes and admin actions, and alert on suspicious patterns. Logging without alerting is A09 in the OWASP Top 10:2025.

Log errors internally, show generic messages to users, and fail closed. OWASP covers this as A10:2025, Mishandling of Exceptional Conditions.

Look for suspicious patterns and attacks.

Turn on Dependabot or a similar service so you hear about known vulnerabilities in your packages.

Get an alert if Google flags the site as malicious, for example through the Security issues report in Search Console.

Keep logs long enough for forensics, and no longer than your privacy policy states.

The steps you take in a security incident. A personal-data breach that is likely to pose a risk must be reported to the supervisory authority within 72 hours (Art. 33 GDPR).