How often should software and plugins be updated?

As soon as security updates are released — delaying updates is one of the most common ways sites get compromised.

Is HTTPS enough to make a site secure?

No — HTTPS protects data in transit but doesn't prevent outdated software, weak passwords or missing backups from causing a breach.

How often should backups run?

At least daily for active business sites, with backups stored somewhere separate from the live server.

Home / Insights / Website Security Checklist

Web Design

Website Security Checklist

August 6, 2026 · 7 min read

Executive summary

Most website breaches come down to outdated software, weak credentials, or missing backups — not sophisticated attacks. A short checklist closes most of the risk.

The direct answer

A website security checklist covers HTTPS everywhere, prompt software and plugin updates, strong unique credentials with two-factor authentication, regular offsite backups, a web application firewall, and limiting third-party plugin or script use to what's genuinely needed.

The checklist

Common mistakes

Frequently asked questions

Key takeaways

Most breaches trace back to outdated software or weak credentials.
Offsite, regular backups are the single best insurance against disaster.
HTTPS is necessary but far from sufficient on its own.

→ Website Redesign Checklist → Website Development (service page)

Website Security Checklist

The direct answer

The checklist

Common mistakes

Frequently asked questions

Related