00 Quick Answer
Short answer: if you only fix a few things this week, force HTTPS, set the core security headers, close unused ports, patch dependencies, and lock down admin access with 2FA and rate limiting. Those steps eliminate a large share of common website risk.
Use this checklist as a recurring operating routine, not a one-time project. Pair it with guides for SSL, headers, input hardening, and WAF coverage so each checklist item turns into a clear fix.
01 Why This Checklist?
Cyber threats evolve. What was secure in 2024 might be a vulnerability today. This checklist is updated for the 2026 threat landscape, focusing on automated bots, supply chain attacks, and sophisticated phishing.
02 Infrastructure & Server
Force HTTPS everywhere
Redirect all HTTP traffic to HTTPS using HSTS. No exceptions.
Disable unused ports
Close ports 21 (FTP), 23 (Telnet), and 3389 (RDP) if not absolutely needed.
Hide server version
Configure Nginx/Apache to stop broadcasting version numbers in headers (e.g., Server: Apache/2.4.41).
Use a WAF
Enable a Web Application Firewall (Cloudflare, AWS WAF) to filter malicious traffic.
03 Application & Code
Sanitize all inputs
Never trust user input. Validate and sanitize form data to prevent SQL Injection and XSS.
Set Security Headers
Implement CSP, X-Frame-Options, and X-Content-Type-Options.
Disable Directory Listing
Ensure users can't browse your file structure (e.g., /images/ or /includes/).
Update Dependencies
Run `npm audit` or use tools like Snyk to find vulnerabilities in your libraries.
04 Access Control
Enforce 2FA
Mandatory Two-Factor Authentication for all admin/staff accounts.
Limit Login Attempts
Ban IPs after 5 failed login attempts to stop brute force attacks.
Principle of Least Privilege
Give users only the permissions they need. Don't give "Admin" access to an "Editor".
05 Monitoring & Backups
Automated Daily Backups
Store them offsite (e.g., AWS S3). Test restoration monthly.
Uptime Monitoring
Use a service (UptimeRobot, Pingdom) to alert you if the site goes down.
Regular Security Scans
Schedule weekly scans with a tool like LamaniSecure to catch new issues.
06 Frequently Asked Questions
Do I need to do everything on this list?
Ideally, yes. Security is a chain — it's only as strong as the weakest link. Start with the 'High Priority' items first.
How often should I run through this checklist?
At least once a quarter. New vulnerabilities appear constantly, and your site configuration might drift over time.
Is this checklist applicable to all platforms?
Yes. Whether you use WordPress, Shopify, React, or custom code, the principles of HTTPS, access control, and monitoring apply universally.
Start Auditing Now
Don't check manually. LamaniSecure automates 80% of this checklist.
Run Automated Audit