Website Security Checklist

Access and credentials

List administrators, owners and recovery contacts. Review least privilege and account lifecycle, confirm MFA where appropriate, and avoid placing credentials in URLs. Record evidence and exceptions instead of marking controls complete from memory.

Updates, backups and transport

Maintain an inventory of application dependencies and supported versions. Record the latest update and restore test, not only the existence of a backup schedule. Check browser connection warnings and application-specific security headers through authorised evidence collection.

Monitoring and review record

Use a worksheet with control, scope, evidence date, owner, status (met/gap/unknown/not applicable), exception, action and due date. Example: a backup exists but has no restore evidence; status is unknown or gap according to the chosen control, not met. Print this page for a review record and document the reviewer’s decision.