Skip to content Hosting · Security
Website Security Checklist: 12 Steps to Protect Your Site
A website gets probed by bots, password guessers, and spam scripts every single day, whether it is a small blog or a busy online store. The good news: most break-ins are not clever. They walk through an open door, like a reused password, a plugin that was never updated, or an old admin account nobody remembers. This website security checklist closes those doors one by one.
It is written for anyone who runs a website: small businesses, bloggers and creators, online stores, nonprofits, and freelancers. You do not need to be technical. Each step tells you what to do, why it matters, and where to find the setting.
Good to know: every Next Wave Host plan already includes a firewall, malware scanning, DDoS protection, account isolation, backups, and free SSL. This checklist covers the part only you can do. See our web hosting security features for how the server side works.
Website security is a team effort
Think of your website like a shop in a guarded building. The building has locks, cameras, and a guard at the door. But if you hand out copies of your shop key, the guard cannot help. Website security works the same way:
What your web host protects
The server, the network, and the building around your site: firewall rules, malware scanning, traffic floods, keeping accounts apart, server updates, and encrypted connections.
What you protect
Everything inside your account: your passwords, who has access, the plugins and themes you install, your backups, your email settings, and your domain name.
The 12-step website security checklist
The steps are grouped into four parts: your logins, your software, your data, and the things worth watching. Work through them in order the first time, then come back every few months.
1. Use a strong, unique password for every login
Password guessing, also called a brute-force attack, is still the most common way into a website. Bots try thousands of leaked passwords against login pages. A long, unique password stops them cold. Change these first:
- Your hosting client area and cPanel
- Your WordPress (or other site builder) admin account
- Your domain registrar account
- The email accounts on your domain
- FTP and database users, if you created any
2. Turn on two-factor authentication
Two-factor authentication (2FA) asks for a one-time code from your phone after your password. Even if someone steals the password, they cannot get in without your phone. cPanel has 2FA built in under Security → Two-Factor Authentication, and WordPress can add it with a well-known security plugin. Turn it on for every account that can change your website.
3. Give each person their own login, with only the access they need
Never share one admin login with a designer, a helper, or a family member. Create a separate account for each person and give them the lowest role that lets them do their job (for example, Editor instead of Administrator in WordPress). When someone stops working on your site, delete their account the same day.
Tip: a password manager creates and remembers long passwords for you, so “unique for every login” becomes easy instead of a chore.
Keep your website software clean
4. Update WordPress, themes, and plugins
Most hacked WordPress sites were running an outdated plugin or theme with a known security hole. Updates close those holes. Check for updates at least once a week, and turn on automatic updates for plugins you trust. Before a big update, make a backup (see step 7) so you can roll back if something breaks. New to WordPress? Our guide on how to build a WordPress website covers the basics.
5. Install plugins and themes only from trusted sources, and delete the rest
Get free plugins and themes from the official WordPress directory and paid ones straight from the developer. Every plugin you install is more code that could have a weak spot, so keep only what you actually use. Deactivated plugins can still be attacked, so delete them instead of just switching them off.
Watch out: “free” copies of paid plugins (often called nulled plugins) are one of the most common ways malware gets onto a website. They also get no updates or support. If a premium plugin is worth using, buy it from its official site.
6. Keep your PHP version current
PHP is the language WordPress and most site builders run on. Old PHP versions stop getting security fixes. In cPanel, open MultiPHP Manager or Select PHP Version to see which version your site uses, and move to a supported one. Test your site afterward; if a plugin complains, that plugin probably needs an update too.
Protect your data and your visitors
7. Turn on backups, and keep a copy of your own
A backup is your undo button for anything: a hack, a bad update, or a page you deleted by mistake. Next Wave Host plans include automated backups with one-click restore points; turn on the backup tool in your control panel to start using them. Then download a full copy now and then and keep it somewhere outside your hosting account. For hands-off off-site backups, the CodeGuard add-on backs up your site every day.
8. Make sure HTTPS is on for every page
HTTPS encrypts everything that travels between your site and your visitors, including passwords, contact forms, and checkout details. Every Next Wave Host plan includes a free SSL certificate. Check that your site address starts with https:// and that the http:// version sends visitors to it automatically. In WordPress, both addresses under Settings → General should start with https://.
Good to know: online stores and businesses that handle sensitive information can upgrade to a premium SSL certificate with business validation.
9. Secure your email with SPF, DKIM, and DMARC
Scammers love to send emails that pretend to come from your domain. Three DNS records tell other mail servers which emails are really yours: SPF, DKIM, and DMARC. In cPanel, Email Deliverability shows whether SPF and DKIM are set up and can fix them in a click. Adding a DMARC record on top protects your name and helps your own emails land in the inbox instead of spam.
Keep watch over your website
10. Scan for malware regularly
Malware often hides quietly: a spam link in a footer, a redirect that only shows to mobile visitors, a file that sends out junk email. Our servers run real-time malware scanning on every plan. If you want daily scans of your website itself plus automatic cleanup, add SiteLock.
11. Monitor your uptime
A hacked or broken site is often noticed by customers first. Uptime monitoring checks your site every few minutes and alerts you the moment it goes down or starts acting strangely, so you can fix it before anyone else notices. The 360 Monitoring add-on does this for you.
12. Lock down your domain name
Your domain is the front door to your website and your email. Keep the registrar transfer lock on, renew well before the expiry date (or turn on auto-renew), and keep the contact email on the domain current so renewal notices reach you. If your personal details are public, our article on the dangers of the WHOIS database explains why that matters. You can manage all of this for domains registered through our domain registration service.
Signs your website may have been hacked
Even with the best website security, it is smart to know the warning signs. Look into it right away if you notice any of these:
- Pages you did not create, or strange links in your content or footer
- Visitors being sent to another website, sometimes only on phones
- Google or your browser showing a “This site may be hacked” warning
- New admin users you did not add
- Customers saying they got spam from your email address
- A sudden drop in speed or a jump in traffic you cannot explain
If something looks wrong, do these things in this order:
- Change every password from step 1, starting with your hosting and admin accounts
- Restore a clean backup from before the problem started
- Update everything and delete any plugins, themes, or users you do not recognize
- Open a support ticket so we can check the server side with you
Important: do not just delete the strange files and move on. Attackers often leave a hidden back door. Restoring a clean backup and changing your passwords closes it.
How Next Wave Host keeps your website secure
While you handle your side of the website security checklist, six layers of protection run on our servers around the clock. They are included with every plan at no extra cost.
Firewall
Blocks malicious traffic and brute-force login attempts before they reach your site.
Malware scanning
Watches files in real time and quarantines anything infected.
DDoS protection
Filters out traffic floods so your site stays online.
Account isolation
CloudLinux keeps every account in its own protected space.
Backups
Daily and weekly restore points, stored away from your server.
Free SSL
Encrypts every connection and puts the padlock in the browser.
Want even more protection? Add SiteLock, CodeGuard, premium SSL, or 360 Monitoring any time. Our guide to website add-ons explains what each one does, and the full list is on our hosting features and add-ons page.
See All Security FeaturesYour website security checklist at a glance
Save or print this short version and check it off every few months:
- ✓ Strong, unique passwords on every login
- ✓ Two-factor authentication turned on
- ✓ One login per person, with the lowest role they need
- ✓ WordPress, themes, and plugins up to date
- ✓ Only trusted plugins and themes; unused ones deleted
- ✓ A supported PHP version
- ✓ Backups on, plus your own copy off the server
- ✓ HTTPS on every page
- ✓ SPF, DKIM, and DMARC set up for your email
- ✓ Regular malware scans
- ✓ Uptime monitoring
- ✓ Domain locked, contact email current, renewal on time
Tip: set a calendar reminder for the first day of every third month. A 20-minute check-up is far easier than cleaning up after a hack.
Final thoughts on your website security checklist
Website security is not one big task. It is a handful of small habits: good passwords, two-factor logins, regular updates, and backups you can count on. Do the 12 steps on this website security checklist once, repeat the check-up every few months, and your site will be a much harder target than most.
Pair those habits with reliable web hosting that protects the server side, and you can spend your time growing your website instead of worrying about it. Every plan, from shared hosting to WordPress hosting, comes with all six layers built in.
Compare Plans & PricesWebsite security FAQs
What should a website security checklist include?
At a minimum: strong, unique passwords, two-factor authentication, regular updates, trusted plugins only, backups you can restore, HTTPS on every page, email authentication (SPF, DKIM, DMARC), malware scanning, uptime monitoring, and a locked domain. The 12 steps above cover all of them.
Doesn't my web host take care of security?
Your host protects the server and the network. At Next Wave Host that means a firewall, malware scanning, DDoS protection, account isolation, backups, and free SSL. But no host can stop someone from logging in with a stolen password or fix a plugin you never update. That part is up to you.
How often should I check my website security?
Check for updates weekly and run through the full checklist every three months. Also review it any time you add a new person, install a new plugin, or change something big on your site.
Is a free SSL certificate secure enough?
Yes. A free SSL certificate uses the same strong encryption as a paid one. Premium certificates add business validation and other extras, which some online stores and businesses prefer, but the encryption itself is just as strong.
What do I do if my website gets hacked?
Change all your passwords, restore a clean backup from before the problem, update everything, remove any users or plugins you do not recognize, and contact our support team so we can check the server side with you.
Need help securing your website?
Not sure where a setting is, or worried something is wrong? Send us a ticket or start a chat and we will walk you through it.
Contact Us