Your website is often the first thing an attacker looks at. Not because your company is special, but because automated scanners check every website on the internet for the same handful of weak spots, every day.
The good news: most of those weak spots are easy to fix. Here are twelve checks, roughly in order of how often we see them go wrong.
The basics
1. HTTPS everywhere, with HSTS. Every page should load over HTTPS, and plain HTTP should redirect to it. Add the Strict-Transport-Security (HSTS) header so browsers never try the insecure version again.
2. A certificate that never surprises you. An expired TLS certificate takes your site offline in practice: browsers show a full-page warning. Use automatic renewal (for example Let’s Encrypt) and monitor the expiry date, because automatic renewal fails silently more often than people think.
3. Modern TLS only. Switch off TLS 1.0 and 1.1. Every current browser supports TLS 1.2 and 1.3.
Security headers
4. Add the essential headers. At minimum:
- Content-Security-Policy: limits where scripts can be loaded from, which makes cross-site scripting much harder.
- X-Content-Type-Options: nosniff: stops browsers from guessing file types.
- Referrer-Policy and a frame-ancestors rule in your CSP (or X-Frame-Options) to prevent clickjacking.
Free tools such as Mozilla’s HTTP Observatory show which headers you are missing.
Logins and software
5. Two-factor login for every admin. Your CMS, hosting panel, domain registrar and DNS provider should all require a second factor. A stolen password alone should never be enough.
6. Hide or restrict admin pages. If only your team uses /wp-admin or /admin, restrict it by IP address or put it behind a VPN or single sign-on.
7. Update the CMS, plugins and themes. Most website break-ins use a known vulnerability in a plugin that already had a fix. Turn on automatic updates where you can, and remove plugins you don’t use.
8. Patch what is actively exploited first. Not every update is equally urgent. Vulnerabilities on the CISA Known Exploited Vulnerabilities list are being used in real attacks, so they come first. Read more in Which vulnerabilities should you patch first?
Around the website
9. Check what else is open. Your web server may expose more than the website: remote desktop (RDP), SSH, a database port or a forgotten test site. Anything that does not need to be reachable from the internet should not be.
10. Protect your domain and email. Lock your domain at the registrar, and publish SPF, DKIM and DMARC records so criminals can’t easily send email in your name.
11. Backups you have actually restored. Keep backups offline or immutable, outside the web server, and test a restore at least twice a year. A backup you have never restored is a hope, not a plan.
12. Monitor continuously. Websites change: a plugin update, a new subdomain, a certificate renewal that fails. A one-off check is outdated next month. Continuous monitoring tells you the moment something drifts.
How OZAG Security helps
OZAG Security monitors your websites and internet-facing systems on a schedule: uptime, certificate expiry, outdated TLS, missing security headers and exposed risky services such as RDP or open databases. You get an alert before a customer or an attacker notices. Try it free for 14 days.