A hacked website rarely announces itself. More often a business owner finds out from a customer who saw a strange redirect, from Google showing a "This site may be hacked" warning, or from a hosting company suspending the account for sending spam. By then the damage to trust and search visibility has already started.
The good news is that most website compromises exploit a short list of avoidable weaknesses. This checklist is written for owners and managers, not developers. You do not need to perform every check yourself, but you should know that each one is being handled and by whom.
Access and accounts
1. Every person has their own login
Shared admin accounts make it impossible to know who changed what, and impossible to remove one person's access without disrupting everyone. Each team member, developer and agency should have a separate account.
2. Admin accounts use multi-factor authentication
Turn on multi-factor authentication (MFA) for the website admin panel, hosting control panel, domain registrar and the email accounts linked to them. An authenticator app is generally stronger than SMS codes.
3. Passwords are long, unique and stored in a password manager
A password manager lets your team use long, random passwords without writing them down or reusing them. Reused passwords are one of the most common ways accounts are taken over after another site's data leaks.
4. Access follows least privilege
Content writers do not need administrator rights. Give each person the lowest role that lets them do their job, and keep the number of full administrators small.
5. Access is removed the day someone leaves
When an employee, freelancer or agency relationship ends, remove their accounts and change any shared credentials they knew. Keep a simple access register so nothing is missed.
Software, hosting and domain
6. The CMS, themes and plugins are updated regularly
Outdated plugins and themes are a leading cause of WordPress and other CMS compromises. Updates should be applied promptly, ideally after testing on a staging copy. Our website maintenance plans exist largely for this reason.
7. Unused plugins, themes and test sites are removed
Deactivated plugins and forgotten staging copies can still be vulnerable. If something is not in use, it should be deleted, not just switched off.
8. Software comes from official sources only
"Nulled" or pirated premium themes and plugins frequently contain hidden malicious code. Always use licensed software from the official developer or marketplace.
9. Hosting is reputable and kept up to date
Your host should keep server software patched, isolate accounts from each other and offer support when something goes wrong. Cheap overcrowded hosting can expose you to problems caused by other sites on the same server.
10. Domain and hosting are registered in the business's name
The domain registrar and hosting accounts should belong to your business, with recovery email and phone numbers you control. Turn on registrar lock and auto-renewal so the domain cannot be transferred or lapse by accident.
Data, forms and payments
11. HTTPS is enforced across the whole site
Every page should load over HTTPS, and any HTTP request should redirect automatically. Certificates should renew automatically so they never expire unnoticed.
12. Forms are protected from spam and abuse
Contact and quote forms should use spam protection (such as a CAPTCHA or honeypot field), limit file upload types and sizes, and validate what users submit.
13. You collect only the personal data you need
Every extra field on a form is extra data to protect. Under the DPDP Act 2023, businesses are expected to collect personal data for a clear purpose and protect it with reasonable security safeguards. Ask whether you really need date of birth, full address or ID numbers.
14. Payment details never touch your server
Use an established payment gateway such as Razorpay, PayU or Stripe with hosted or embedded checkout, so card and UPI details are handled by the gateway rather than stored on your website.
Backups and recovery
15. Backups run automatically and are stored off the server
A backup that lives only on the same server as the website disappears with it. Keep automated backups in a separate location as well.
16. Backups include both files and the database
A website is usually two things: files (code, images, uploads) and a database (pages, orders, users). Both must be backed up together.
17. Restores are actually tested
Pick a date every quarter to restore a backup to a test environment. A backup that has never been restored is a hope, not a plan. The 3-2-1 backup rule - three copies, on two types of storage, with one kept off-site - is a simple standard to aim for.
Monitoring and people
18. Uptime and security monitoring are switched on
Uptime monitoring alerts you when the site goes down. Security tools or a web application firewall can block common automated attacks and alert you to suspicious file changes.
19. Google Search Console is verified
Search Console notifies the site owner if Google detects malware, hacked content or manual actions. It is free and should be connected to an email address you actually read.
20. Your team knows what to do if something looks wrong
Write down who to call, where backups are, and who holds hosting and domain logins. A short written incident response plan saves hours of confusion on a bad day.
Who owns each check?
Use this table to assign responsibility. Fill in names, not job titles.
| Area | Checks | How often | Typical owner |
| --- | --- | --- | --- |
| Access and accounts | 1 - 5 | On every joiner or leaver, and quarterly review | Business owner or office manager |
| Software and hosting | 6 - 10 | Weekly or monthly updates | Developer or maintenance partner |
| Data and forms | 11 - 14 | At launch and when forms change | Developer, approved by owner |
| Backups | 15 - 17 | Daily or weekly backups, quarterly restore test | Maintenance partner, verified by owner |
| Monitoring and people | 18 - 20 | Continuous alerts, yearly plan review | Shared |
Quick wins you can do this week
If the full list feels like a lot, start here:
- Turn on MFA for website admin, hosting, domain and email
- Confirm the domain is in your business's name and set to auto-renew
- Ask your developer when the last backup was taken and when it was last restored
- Remove accounts for anyone who no longer works with you
- Verify your site in Google Search Console
Signs your website may already be compromised
Sometimes the checklist comes too late. Ask your developer to investigate promptly if you notice any of these:
- Visitors, especially on mobile, are redirected to unrelated or spammy websites
- Google search results show your site with strange titles, foreign-language text or pharmacy and gambling terms
- Google Search Console reports security issues or a sudden spike in unfamiliar pages
- New admin users appear that nobody in your team created
- Your hosting provider warns about high resource usage or outgoing spam
- Customers report unexpected emails or pop-ups linked to your domain
Do not simply delete suspicious files and move on. The cause, such as an outdated plugin or a leaked password, needs to be found and fixed, or the problem usually returns.
Questions to ask your developer or hosting provider
You do not need to understand every technical detail, but the answers to these questions tell you a lot:
- When were the CMS, theme and plugins last updated, and who does it?
- Where are backups stored, how often are they taken, and when was a restore last tested?
- Is there a web application firewall or security plugin, and who receives its alerts?
- Who has administrator access to the website, hosting and domain today?
- If the site were hacked tonight, what would happen first, and how quickly?
Clear, confident answers are a good sign. Vague replies point to the areas to fix first.
Key takeaways
- Most website compromises exploit weak logins, outdated software and missing backups
- MFA, unique passwords and least-privilege access protect the front door
- Updates, licensed software and good hosting close the most common gaps
- Collect less data, enforce HTTPS and let the payment gateway handle payments
- Backups must be off-server, complete and tested
- Every check needs a named owner
If you would like an owner-friendly review of your website against this checklist, book a free consultation. Our team will go through your site, hosting and access setup and give you a clear list of fixes. Learn more about our cyber security services, or our WordPress development team if your site runs on WordPress.
