Free practical guide · Coriable Ghana
Small Business Website Security Checklist
Security is an operating practice. Use this checklist to review website threats that can affect customer information, payments, email reputation and business continuity.
Reviewed 29 October 2026 · For business owners, marketing teams and project managers
1. Secure identities and administration
Use unique accounts, multi-factor authentication for privileged users, least-privilege access and protected password recovery. Remove accounts that are no longer required and review administrator activity.
- MFA enabled for privileged users
- Default credentials replaced
- Server-side permissions checked
- Access reviewed after staff changes
2. Keep runtime and dependencies supported
Check the actual PHP version used by the production domain, not only the version shown in a developer terminal. Apply vendor security updates to PHP, web server components, themes, plugins and dependencies.
- Production PHP and libraries patched
- Unused components removed
- Staging deployment checks
- Dependency audit and software inventory
3. Protect public forms and files
Validate every input on the server. Add bot challenge verification, sensible request limits and duplicate-submission protection for enquiry forms. Restrict uploads by type, size, content and storage location; scan documents with an operational malware scanner.
- Form challenge verified server-side
- Email and lead abuse controls active
- Upload types restricted and scanned
- Uploaded files not executable
4. Protect money and private records
Verify payment events with the provider, use idempotent transaction processing and never rely on browser-reported payment success alone. Test that one customer cannot read another customer’s invoices, messages or documents.
- Payment webhook signatures checked
- Duplicate event protection
- Tenant isolation tested with two accounts
- Sensitive exports restricted and audited
5. Prepare for a disruptive incident
Maintain backups outside the primary server, test restoration and document who can disable affected access or notify customers when necessary. Malware, ransomware and data exposure require containment and a practiced recovery process.
- Offline or immutable backups available
- Restore test documented
- Security owner and escalation contacts assigned
- Incident response and communications plan
