Introduction
Security isn’t a feature; it’s a process. Use this checklist as a baseline and re-run it quarterly (or with every major deployment).
1) TLS & HTTPS
2) Security Headers
- Content-Security-Policy (CSP), X-Content-Type-Options, Referrer-Policy, X-Frame-Options, Permissions-Policy.
- Scan with SecurityHeaders.com: SecurityHeaders.com / Mozilla Observatory: Mozilla Observatory CERT-IN
3) WAF/CDN & DDoS Protection
- Put your site behind Cloudflare (WAF rules, bot management, rate limiting).
- Cloudflare (link in your affiliate stack)
4) Patch & Dependency Hygiene
- Keep CMS, themes, plugins, and OS packages updated.
- Use Dependabot / Renovate for automated dependency PRs.
5) Auth & Access
- MFA for all dashboards (hosting, CMS, DNS).
- Strong roles / least privilege; no shared root credentials—use a password manager.
6) Backups & Restoration
- Offsite, versioned, tested restores.
- For WordPress, pair UpdraftPlus with object storage (S3/Wasabi).
7) Malware & Vulnerability Scans
- Sucuri SiteCheck for quick external checks: Sucuri SiteCheck TechRadar
- Consider deeper DAST tools and scheduled scanning.
8) Input Validation & App-Layer Risks
- Validate server-side; sanitize user-generated content.
- Revisit the OWASP Top 10 as a living reference: OWASP Top 10 CERT-IN
9) Secrets & Environment
- Keep secrets out of repos; rotate keys; use env stores and KMS.
- Restrict SSH by IP, use keys, and disable password authentication.
10) Monitoring & Logging
- Centralized logs, anomaly alerts, and threshold-based paging (Sentry, CloudWatch, ELK).
11) Forms & Uploads
- Anti-spam, file type/size validation, AV scanning, and signed URLs.
12) Third-Party Scripts
- Audit tags regularly; use CSP nonces and Subresource Integrity (SRI).
13) Compliance & Data
- Cookie consent where required; map data flows and retention; honor deletion.
Quick Tool Belt
- SSL Config: SSL Labs
- Headers: SecurityHeaders.com / Mozilla Observatory
- Surface Scan: Sucuri SiteCheck
- Deeper Testing: Burp Suite, OWASP ZAP (widely referenced by security communities and round-ups) TechRadar
Leave a Reply