Website security can feel like a specialist job, especially when you are busy running a business. But you do not need to inspect every technical setting each month to reduce common risks.
A simple routine can help you spot neglected updates, failed backups, former users with access, expired certificates, and changes you did not approve. The goal is not perfect security—no checklist can eliminate every risk. The goal is to make important checks regular and catch avoidable problems early.
Your monthly website security checklist
Set aside a short block of time each month and work through the following areas. You may need help from your hosting company, website provider, or developer for some tasks.
1. Check that backups are running—and can be restored
A backup is a separate copy of your website and its important data. It can help you recover after an accidental change, technical failure, or security incident.
First, check that recent backups exist. Look in your hosting, website, or e-commerce platform account for the latest backup date. Confirm that backups include the parts your business needs, such as:
- Website files and settings
- Product, order, or booking data, where relevant
- Customer or enquiry information, handled in line with your privacy obligations
- Databases, if your website uses one
Seeing a recent backup is useful, but it does not prove that the backup will work. A backup can be incomplete, damaged, or difficult to use when you need it.
At sensible intervals, confirm that a backup can actually be restored. Your hosting provider or website support team may be able to restore it to a test location without replacing your live website. If you do not know how restoration works, ask them to explain the process and what information they need from you.
Do not make a live restore just to test it unless you understand the consequences. A test restore should not overwrite current orders, enquiries, or website changes.
2. Apply updates carefully
Updates may be available for your website platform, themes, plugins, e-commerce tools, server software, or other services. They can include security fixes as well as improvements and bug fixes.
Before applying updates:
- Confirm that a recent backup exists.
- Note which components you are updating.
- Check whether your provider recommends a particular order or process.
- Avoid making several unrelated changes at the same time if you may need to identify a problem.
After updating, test the parts of the website customers rely on. Open the homepage, several important service or product pages, the contact or quote form, and any booking or payment flow. Check that notifications still arrive at the right email address.
If an update causes an error, do not keep trying random fixes. Record what changed and contact your provider or support person. Some updates need compatibility checks, particularly on older or heavily customised websites.
3. Review administrator accounts and access
An administrator account can change important website settings, publish content, install software, view customer information, or manage payments. Review the list of people and services with access to your website, hosting account, domain registrar, email provider, and payment tools.
Remove unused administrator accounts promptly, especially accounts belonging to former employees, agencies, freelancers, or suppliers. If someone no longer needs access, they should not remain listed “just in case.” Where possible, give people only the level of access they need for their role.
For active accounts:
- Use a strong, unique password for each important service.
- Turn on multi-factor authentication (MFA) where the website, hosting provider, domain registrar, email provider, or other service supports it. MFA asks for an additional verification step, such as an authenticator-app code.
- Keep recovery email addresses and phone numbers current.
- Review recent sign-in activity when the service provides it.
Your email account deserves particular attention because it may be used to reset other passwords or approve changes to your domain and website.
4. Check HTTPS, forms, and customer journeys
HTTPS is the secure connection used when a browser communicates with your website. Visitors will often see a padlock or other browser indication when it is working correctly. Check that your main website address loads with https:// and that important pages do not show certificate warnings or “not secure” messages.
An SSL/TLS certificate helps enable HTTPS. Certificates can expire or be misconfigured, so do not assume this will take care of itself. If you see a warning, contact your host or website provider promptly rather than telling customers to ignore it.
Then test the actions customers use to contact or buy from you:
- Contact and quote forms
- Booking or appointment requests
- Newsletter sign-ups, if relevant
- Shopping cart and checkout pages
- Payment confirmation pages
- Automated email notifications
Use a test submission where possible, and confirm that it reaches the intended inbox. Check spam or junk folders if a message does not arrive. For a live payment system, use its documented test mode or follow the provider’s testing instructions rather than placing unnecessary real orders.
5. Look for changes you did not make
A monthly visual check can reveal problems that automated tools or dashboards may not make obvious. Look through the homepage, navigation, key landing pages, and a few product or service pages.
Pay attention to warning signs such as:
- New administrator accounts or unfamiliar users
- Unexpected pages, links, pop-ups, or redirects
- Messages, images, prices, or contact details you did not add
- Website pages that suddenly look different
- Browser or hosting warnings
- Unusual password-reset or sign-in emails
- Customers reporting strange behaviour
Do not click suspicious links in unexpected emails, and do not assume a message is genuine because it appears to come from a familiar service. Access the provider by typing its known web address or using a trusted bookmark.
6. Check renewal dates and keep a simple log
Record the renewal dates for your domain name, hosting plan, SSL/TLS certificate if it is managed separately, and important third-party services. Set reminders well before the due dates and make sure payment details are current.
Your monthly security log does not need to be complicated. A spreadsheet or note can include:
- Date of the check
- Person who completed it
- Backup date and whether a restore test was completed
- Updates applied
- Accounts removed or changed
- Important pages and forms tested
- Problems found and who is handling them
- Upcoming renewal dates
This record helps you notice repeated failures and gives a support provider useful information if something goes wrong.
If you suspect a website security problem
If you find an unfamiliar administrator, a redirect, a defaced page, or another sign that someone may have accessed the site, avoid making random changes before the situation is assessed.
Use this basic response list:
- Preserve access to your main email, hosting, domain, and website accounts if you still have it.
- Contact your hosting company, website provider, or support team and explain exactly what you found and when.
- Reset affected credentials using a trusted device, starting with email and administrator accounts. Use unique passwords and MFA where available.
- Record suspicious messages, account names, times, URLs, and screenshots without sharing sensitive information publicly.
- Ask the provider to assess the website before deleting files, reinstalling software, or restoring an old backup.
If customer, payment, or personal information may be involved, you may also need to follow your legal, contractual, insurance, or payment-provider reporting requirements.
When to ask for help
Ask for professional help if a backup cannot be restored, updates repeatedly fail, the website uses unsupported software, or you find signs of unauthorised access. You should also get help if you are not sure who controls your domain, hosting, or administrator accounts.
A support provider can help establish a safer maintenance process, but no hosting type, platform, or hand-coded website is automatically secure. Ongoing care and sensible access controls still matter.
Printable monthly recap
- [ ] Confirm a recent backup exists
- [ ] Confirm a backup restoration process, and complete a safe restore test when appropriate
- [ ] Back up before applying updates
- [ ] Apply necessary website, platform, plugin, theme, or server updates carefully
- [ ] Test the homepage, key pages, forms, notifications, and booking or payment flows
- [ ] Review administrator and related service accounts
- [ ] Remove unused accounts promptly
- [ ] Check strong unique passwords and MFA where available
- [ ] Confirm HTTPS works without browser warnings
- [ ] Look for unfamiliar changes, redirects, messages, or sign-ins
- [ ] Review domain, hosting, certificate, and service renewal dates
- [ ] Record what you checked and any follow-up actions
If you want a provider to handle hosting, maintenance, edits, and support, SiteRook offers these services depending on the plan. See current plans and pricing for details.