Before launching a website, many businesses focus on page design and content completeness, often leaving security for later. However, once live, your site is continuously exposed to the public internet. Without solid foundational security, ongoing maintenance becomes reactive and stressful. Here's a practical security checklist for business websites, organized into three phases: preparation, execution, and review.
Phase 1: Preparation – Inventory Assets and Permissions
Start by identifying all entry points and accounts, including the website admin panel, server management console, database tools, and FTP/SSH access. Create a table listing each entry point's URL, login method, and current permissions for systematic review.
For account permissions, clearly define roles like administrator, editor, and uploader, granting only necessary access. For instance, regular editors shouldn't have server management rights, and customer support staff shouldn't access the database. Before launch, remove or reset accounts of former employees or external contractors who previously had system access.
Phase 2: Execution – Check Key Security Items
1. Admin URL and Login Protection
Avoid default admin paths (e.g., /admin) and use a less predictable URL. Verify that login CAPTCHA or two-factor authentication is enabled to prevent brute-force attacks. If supported, implement login attempt limits and temporarily lock IPs after repeated failures.
2. File Upload and Directory Permissions
Ensure upload directories prohibit script execution. For example, image upload folders should be read-only and unable to run PHP or ASP scripts. If the site has file management features, confirm that regular users cannot access system configuration files.
3. Database and Backup Strategy
Don't use 'root' or 'admin' as database accounts; use strong, unique passwords. Confirm the backup plan: Is automatic backup configured? Are backups stored outside the website directory? Keep at least the last 7 days of backups and regularly test the restoration process.
4. Common Vulnerability Checks
Check for known vulnerable plugins or components, especially in open-source CMS like WordPress or DedeCMS. Update to the latest versions and remove unused plugins and themes. Also, test for SQL injection and XSS vulnerabilities by submitting special characters in forms, but avoid affecting live data.
5. HTTPS and Sensitive Information Protection
Ensure HTTPS is enabled site-wide, especially for login and payment pages. Force HTTPS for admin logins to prevent password interception. Review source code for exposed database credentials, API keys, or other sensitive data.
Phase 3: Review – Verify Checks and Backups
After checks, perform actual tests. Log in with a non-admin account to confirm only permitted functions are visible. Try accessing the admin URL to ensure it's blocked or requires verification. Additionally, conduct a manual backup restoration drill to confirm backup files are usable and steps are clear.
Security isn't a one-time task; schedule regular reviews post-launch. Recommend quarterly checks of account permissions and backup status. After each site update, re-check file permissions and vulnerabilities. For sites handling user data or transactions, increase security investment and consider professional penetration testing if needed.
This checklist suits most corporate showcase websites. For e-commerce or sites collecting personal information, additional compliance requirements (e.g., MLPS) apply—consult a professional service provider for tailored advice.
