Guide

Website Security Checklist for Small Sites

Building a website is exciting, but it’s also important to build it securely. Here’s a simple checklist to help you protect your site and your visitors’ data:

1. HTTPS – The Foundation of Security

• What it is: HTTPS (Hypertext Transfer Protocol Secure) encrypts the data sent between your website and a user’s browser. This prevents eavesdropping and tampering.
• How to do it: Get a free SSL/TLS certificate from Let’s Encrypt. Most web hosting providers offer easy integration. Ensure your website uses HTTPS by default.
• Why it matters: Without HTTPS, sensitive information like passwords and credit card details are vulnerable.

2. Secrets – Keep Them Safe!

• Database Passwords: Never, ever hardcode database passwords directly into your website’s code. Use environment variables or a configuration file stored outside of your website’s codebase.
• API Keys: Similarly, protect API keys (for services like Google Maps, Twitter, etc.). Store them securely, ideally using a secrets management system.
• Configuration Files: Secure your configuration files – they often contain sensitive settings. Limit access and monitor changes.

3. Dependencies – Manage Your Software

• Keep Them Updated: Regularly update all third-party libraries and frameworks your website uses. These updates often contain critical security patches.
• Use a Package Manager: Employ a package manager (like npm for JavaScript or pip for Python) to manage your dependencies. This helps track and update them easily.
• Vulnerability Scanning: Use tools to scan your dependencies for known vulnerabilities.

4. Input Validation – Don’t Let Bad Data In

• Validate All Input: Every piece of data entered by a user – form fields, URL parameters, etc. – should be validated.
• Sanitize Data: Clean the data to remove potentially harmful characters or code.
• Prevent SQL Injection: Use parameterized queries or prepared statements to prevent malicious SQL code from being executed.

5. Backups – Be Prepared for the Worst

• Regular Backups: Schedule regular backups of your website’s files and database.
• Offsite Storage: Store your backups in a separate location from your website’s server to protect against disasters

This guide was drafted with AI assistance and passed an automated accuracy and safety review. Spotted a mistake? Tell us.