Website Security Checklist: 12 Checks Before You Get Hacked
Most hacked websites fall not to sophisticated attacks but to delayed updates, weak passwords or old accounts nobody switched off.
Use this list as a periodic check, for example every three months. Almost all of it needs no expensive tools. If something is unclear, ask your website manager or vendor to explain the answer in writing.
What are the 12 checks?
- HTTPS on for all pages, with an unexpired certificate and redirect from http.
- Updates installed for the CMS (such as WordPress), themes and plugins. Delayed security updates are the most common way in.
- Remove unused plugins and themes. Even deactivated ones can contain flaws.
- Strong, unique admin passwords, not reused elsewhere, stored in a password manager.
- Two-step verification for admin login, hosting and domain email.
- Clean up the account list. Disable former staff and old vendors; grant only the access needed.
- Automatic backups stored off the website server, and restore-tested at least once.
- Sensible file permissions: files need not be writable by everyone, and upload folders must not execute scripts.
- Limit login attempts and hide or protect the admin login page.
- File change monitoring or alerts for new unknown files.
- Registrar and DNS accounts protected with strong passwords and two-step verification; domain locked and contact email active.
- Logs kept long enough to trace an incident.
What are the signs of online-gambling injection?
- Google results for your site name show titles or descriptions with gambling or slot words.
- Pages look normal to you but different to visitors from Google (cloaking).
- New files or pages you never created, or hidden links in the footer.
- Searching
site:yourdomain.go.idon Google shows unknown pages.
What to do if you are already hit
- Do not just delete the visible pages. Intruders usually leave a backdoor to return.
- Change all passwords (admin, hosting, database, FTP) and disable unknown accounts.
- Restore from a clean backup if you have one, then install all updates.
- Find and remove unknown files, then recheck afterwards.
- Request a review in Google Search Console once clean.
- Record the timeline for internal reporting, and report per your agency's procedure if needed.
Who should be responsible?
Name one responsible person, not just "the IT team", and write security maintenance into the vendor contract, including who applies updates and how fast. A website built once and then left alone is the main cause of this problem.
Sentra helps with website checks, repair and maintenance. See technology consulting, custom software and website services.
Frequently asked questions
How often should a website be checked?
A light security check every three months, and security updates as soon as they are released. Agency sites or those holding user data need it more often.
Are backups alone enough?
No. Backups help recovery but do not prevent attacks. Also fix updates, passwords and two-step verification, and test restoring.
How do I know the site is clean after cleanup?
Recheck a few days later: look for new unknown files, check Google results and watch login logs. Attackers often return through a backdoor.
Is a static website safer?
Generally its attack surface is much smaller because there is no exposed database or admin panel, but hosting and domain accounts still need securing.
Tell us about the process. We'll help map out the most proportionate approach.
