Security checklist for a business website: the 20 items we verify

The short answer

The security of a typical business website comes down to twenty items across five areas: ownership and accounts, transport and headers, forms and functions, secrets and dependencies, and monitoring and response. Most are configuration and discipline rather than products, and a static site served through a network layer satisfies many of them by construction. What makes the list a control rather than a document is that each item has a way to be confirmed, before launch and on every monthly check, with the result in the report. An item that cannot be confirmed is treated as failing until it can. A site that passes all twenty is better protected than the ordinary business site, and the whole list can be brought from failing to passing within a week on a modern platform.

The twenty items

#	Item	Protects against	How we confirm it
1	Domain registered in the business’s name, locked, auto-renewing	Loss of the domain	Registrar account and WHOIS checked
2	Two-factor authentication on registrar, DNS, hosting, repository and email accounts	Account takeover	Each account’s security settings checked
3	Per-person accounts with least privilege; no shared logins	Untraceable access; messy offboarding	Member lists reviewed; access register current
4	Hosting project and repository owned by the business’s organisation	Dependence on a supplier’s personal account	Ownership pages checked
5	HTTPS everywhere with valid certificates and automatic renewal	Interception; browser warnings	Certificate checked; renewal automated
6	HSTS enabled	Downgrade to insecure connections	Header present with a long max-age
7	Security headers set: content type options, frame options or frame ancestors, referrer policy, permissions policy	Framing, sniffing and leakage attacks	Header scan clean
8	Content security policy in place and enforced	Injected scripts running	Policy present; violations monitored
9	No mixed content	Padlock loss; partial interception	Crawl clean
10	Forms validated on the server, with a bot check and a honeypot	Spam floods and injection through forms	Test submissions with malformed input rejected
11	Rate limits on forms, functions and any login	Floods, guessing, runaway costs	Limit events visible in logs; test hits the limit
12	Functions send only to fixed destinations; no user-controlled recipients	Site used as a spam relay	Function code and configuration reviewed
13	Secrets only in platform secret storage; none in code, history or front end	Leaked keys	Repository history scanned; front-end bundle inspected
14	One key per integration with minimal permissions	Blast radius of a leak	Provider dashboards reviewed
15	Dependency scanning on every build; updates applied within defined times	Known vulnerabilities in packages	Pipeline configuration; last advisory handled on time
16	Third-party scripts registered, minimal, loaded after consent where required	Data leakage; supply chain	Network panel matches the register
17	Network layer in front with managed protection; origin not directly reachable	Floods and scanners	Direct origin request fails; layer analytics show blocks
18	External monitoring of uptime, certificates and domain expiry, with alerts to named people	Undetected outages and expiries	Test alert received
19	Backups of anything not in the repository, stored elsewhere, restore tested	Data loss	Last restore test dated
20	One-page incident response plan with roles and contacts	Slow, chaotic response	Plan exists, dated within a year, people know it

Running the checklist

What the architecture gives you for free

A static site behind a network layer passes several items by construction: no server code to inject into, no database to protect, no public admin to defend, floods absorbed at the edge, files served with headers set once. The remaining items are the accounts, the forms and functions, the secrets, the dependencies and the monitoring, which is a manageable list and mostly discipline.

What this means for you

Twenty items, verified with evidence before launch and re-confirmed monthly, cover the security of a business website: accounts and ownership, transport and headers, forms and functions, secrets and dependencies, monitoring and response. Most are configuration and discipline, a static architecture satisfies many by construction, and any site can pass all of them within a week. Insist on the list with dates, and read it every month.