Basic Website Security Quick-Check

1. Secure Access Controls

• Confirm that all admin logins use strong, unique passwords (12+ characters, mix of letters, numbers, symbols).
• Enable two‑factor authentication (2FA) for any account with dashboard or server access.
• Review user accounts and remove any that are no longer needed.

2. HTTPS and Certificate Validation

• Check that your site loads with https:// in the address bar and shows a padlock icon.
• Verify the SSL/TLS certificate is not expired (use an online SSL checker).
• Redirect all http traffic to https via a permanent (301) redirect rule.

3. Core Software Updates

• Log into your CMS (WordPress, Joomla, etc.) and note the current version.
• If a newer version is available, apply the update following the platform’s backup guidelines.
• Update all plugins, themes, and extensions to their latest versions.

4. Email Spoofing Protection

• Add an SPF record to your domain’s DNS that lists authorized sending servers.
• Create a DKIM record for your email service provider and publish the public key in DNS.
• Set up a DMARC policy (e.g., p=none) to start receiving reports on spoofing attempts.

5. Basic Backup & Monitoring

• Schedule automated daily backups of your site files and database to a separate storage location.
• Test a backup restore on a staging environment to ensure it works.
• Install a simple uptime monitoring service that alerts you if the site goes down.