Why Perform a Basic Website Security Check
After prolonged operation, corporate websites can accumulate hidden risks such as program vulnerabilities, weak passwords, and outdated plugins. Conducting a basic security check regularly helps detect common threats early, preventing website defacement or malicious code injection. This checklist applies to most CMS-based corporate websites (e.g., WordPress, DedeCMS, Empire CMS) as well as custom-developed sites.
Detailed Checklist Steps
1. Login and Account Security
- Confirm whether the default admin account (e.g., admin) is still in use; it is recommended to change it to a custom name.
- Check the password strength of all user accounts. Weak passwords should be reset to a combination of letters, numbers, and symbols, with a minimum length of 8 characters.
- Review recent login records for any abnormal IP addresses or unknown devices.
- Deactivate unused accounts, especially those of former employees; delete or disable them promptly.
- Verify whether the backend login URL has been modified. If not, consider changing it to a custom path.
2. Core Program and Plugin Updates
- Log into the website backend or check version information to ensure the CMS core program is the latest stable release.
- List all installed plugins, themes, or modules, and check each for new versions. Remove any unused plugins.
- Monitor official security announcements and prioritize updating components with reported vulnerabilities.
- If using third-party plugins, choose those that are actively maintained and regularly updated.
3. File and Directory Permissions
- Check write permissions for the root directory and upload directories: directories that do not require write access should be set to 755, while those needing write access (e.g., upload, cache) can be set to 755 or 777, but ensure security policies are in place.
- Confirm that configuration files (e.g., config.php, wp-config.php) have permissions set to 644 or lower, preventing direct external access.
- Remove unnecessary files, such as installation scripts, sample files, and test pages.
4. Data Backup Strategy
- Verify that backups cover both website files and databases, and that the backup frequency is reasonable (daily automatic backups are generally recommended).
- Test whether backup files can be successfully restored; do not rely solely on backup task success indicators.
- Ensure backup files are stored in a location separate from the website root directory to prevent direct download via URL.
5. HTTPS and SSL Certificates
- Confirm that the entire website uses HTTPS, with a padlock icon displayed in the browser address bar.
- Check the SSL certificate's validity period and renew or replace it at least 30 days before expiration.
- Ensure HTTPS configuration is correct, with no mixed content warnings.
6. Logs and Monitoring
- Enable website access logs and error logs, retaining them for at least 30 days.
- Regularly review logs for abnormal records such as scanning, brute-force attacks, or SQL injection attempts.
- If possible, deploy simple security monitoring tools, such as file integrity checks or login failure alerts.
Recommended Check Frequency
A basic check is recommended every quarter, but immediate checks should be performed in the following situations:
· After a major security update for the program
· When the website exhibits anomalies (e.g., page defacement, unexpected ads)
· After server or hosting environment changes
· After adding new third-party plugins or functional modules
Frequently Asked Questions (FAQ)
Q: Without a dedicated security team, is it sufficient to follow this checklist on my own?
A: The basic checklist can prevent most common risks. However, if the website handles user data or transactions, it is advisable to periodically engage professional security services for vulnerability scanning.
Q: What should I do if I find files have been tampered with during a check?
A: Immediately take the website offline and restore files from a backup. Then investigate the intrusion method and strengthen login and plugin update management.
Q: Can some check items be automated?
A: Yes. Some CMS platforms offer security plugins that can automatically detect file permissions and notify about updates, but login log reviews and backup restoration tests still require manual confirmation.
Summary and Next Steps
Regularly performing a basic security check is a fundamental operation to ensure the stable operation of a corporate website. Following this checklist item by item helps prevent most low-level vulnerabilities from being exploited. After completing the check, it is recommended to document the results and record any remediation actions for comparison during the next review. If technical capabilities are insufficient to handle complex issues, consider outsourcing security maintenance to professional website operations service providers.
