Website Security Checklist for Beginners: Protect Your Hosting, CMS, and Domain

Overview

Website security for beginners is mostly a matter of reducing avoidable risks and making recovery possible. You do not need to understand every server log or security alert to create a sensible baseline. Start with the accounts that control your site, then secure the software and settings that visitors interact with.

There are four layers to review:

• Access: Protect the hosting account, domain registrar, CMS administrator accounts, email accounts, and recovery methods.
• Configuration: Confirm domain locks, DNS records, HTTPS, file permissions, and administrator roles.
• Software and content: Keep the CMS, themes, plugins, extensions, and contact forms maintained.
• Recovery: Keep usable backups and document who can restore the site if an account is compromised or a change breaks the website.

Security controls vary between free website hosting, paid hosting, website builders, and self-managed WordPress installations. Check what your provider includes instead of assuming that every feature is available. For broader launch preparation, use this website launch checklist alongside the steps below.

Priority guide

Checklist by scenario

Before launching a new website

1. Secure the primary accounts. Use a long, unique password for the hosting account, domain registrar, CMS administrator account, and email account connected to recovery. A password manager can help you avoid reusing credentials.
2. Turn on multi-factor authentication. Enable MFA wherever the registrar, host, CMS, email provider, or site builder supports it. Store recovery codes in a safe place that is separate from the website itself.
3. Confirm ownership and recovery details. Make sure the domain registration email, hosting contact, and recovery phone or email belong to the current site owner. Remove old contacts and former administrators.
4. Check domain protection. Enable registrar lock or domain lock when available, and review transfer, renewal, and privacy settings. Domain protection does not replace a strong registrar password, but it can add a useful barrier against unauthorized changes.
5. Review DNS records. Keep only records you recognize and need. Check the nameservers, website address records, email records, and any verification records used by services connected to the domain. Do not delete an unfamiliar record without first identifying its purpose.
6. Verify HTTPS. Visit the site using its HTTPS address and check that the browser does not show a certificate warning. Test the preferred version of the domain, including whether the non-preferred version redirects correctly.
7. Update the CMS and extensions. Install supported updates for the CMS, theme, plugins, and other extensions. Remove anything unused rather than leaving inactive components installed.
8. Limit administrator access. Give each person an individual account and the lowest permission level needed. Avoid sharing one administrator login, because shared access makes changes difficult to trace and harder to revoke.
9. Set up backups. Confirm what the host or platform backs up, how long copies are retained, and whether you can download or restore them. A backup is more useful when you know where it is and how restoration works.
10. Test public features. Submit contact forms, check error pages, inspect downloads, and confirm that private drafts or administrative URLs are not exposed. For form-specific checks, see the contact form setup guide.

For a WordPress or other CMS website

Use the CMS dashboard to review the version, themes, plugins, extensions, and user list. Replace default administrator names where the platform permits it, remove test accounts, and disable or delete unused components. Turn on automatic updates only when you understand how the platform handles compatibility and backups; otherwise, schedule controlled updates and check the site afterward.

Do not install a security plugin or extension solely because it has a long feature list. Confirm that it is maintained, compatible with your CMS version, and necessary for your setup. A small set of maintained components is generally easier to review than a crowded installation. If you use WordPress on a free plan or shared environment, check the provider's restrictions before changing server-level settings.

For a static site or website builder

Static sites and hosted builders may reduce the amount of server software you manage, but the hosting, domain, and publishing accounts still need protection. Secure the account used to deploy or edit the site, review connected integrations, and remove old collaborators. Confirm that HTTPS is active and that forms, analytics tools, embedded content, and custom scripts come from services you recognize.

If you are comparing a free website builder with traditional hosting, include account recovery, custom-domain controls, backups, update responsibility, and support options in the comparison—not only templates and storage.

What to double-check

Hosting and domain access

• Use a separate password for each critical account.
• Review active sessions, API keys, SSH keys, deployment tokens, and connected applications if the provider exposes them.
• Remove former users and rotate shared credentials after a staff or ownership change.
• Check the domain expiration date and renewal method. The domain renewal checklist can help prevent both access problems and accidental downtime.

DNS and HTTPS

Compare the current DNS records with a saved note or export from a known-good configuration. Pay particular attention after changing hosts, nameservers, email providers, or domain registrars. Verify that the website loads on the intended domain, that redirects do not create a loop, and that important pages do not contain insecure resources that trigger browser warnings.

Backups and recovery

Keep at least one backup copy outside the live hosting account when your plan and platform allow it. A backup should include the website files and, for database-driven sites, the database. Record the date, location, and restoration steps. Test a restoration on a temporary location or staging environment when possible; a backup that has never been tested should be treated as unconfirmed.

Spam, malware, and monitoring

Protect public forms with the anti-spam controls supported by your platform, and avoid publishing unnecessary personal contact details. Watch for unexpected administrator accounts, changed DNS records, new files, redirects, browser warnings, or sudden messages from visitors about unusual pages. If you suspect malware or account takeover, preserve evidence, change credentials from a trusted device, contact the relevant host or registrar, and restore only from a known-clean backup.

Common mistakes

• Using one password everywhere: A compromised email or registrar account can expose the rest of the site. Use unique credentials and MFA.
• Leaving an old administrator active: Remove accounts that no longer have a business reason to exist, including temporary developer or contractor access.
• Ignoring the domain account: Website security includes the registrar. Someone who controls the domain can redirect visitors even if the hosting server is secure.
• Updating without a recovery plan: Updates are important, but take a backup first and know how to undo a failed change.
• Installing too many security tools: Overlapping plugins and scripts can create conflicts and make maintenance harder. Choose tools that fit the platform and keep them maintained.
• Assuming HTTPS solves everything: HTTPS protects data in transit between the visitor and site, but it does not prevent weak passwords, vulnerable software, stolen sessions, or unauthorized DNS changes.
• Never checking free-hosting limits: Some free hosting plans may limit backups, server access, scheduled tasks, or security controls. Review the provider's current documentation before relying on a feature. See free hosting limits for questions to ask before you need an upgrade.

When to revisit

Use the full checklist before launch, after changing hosts or domains, and whenever a new administrator, theme, plugin, integration, or payment feature is added. For a small personal or business site, a short monthly review is a practical baseline:

1. Check account activity, users, MFA, and recovery contacts.
2. Apply pending CMS, theme, plugin, and platform updates after confirming a backup.
3. Review DNS records, domain status, HTTPS, forms, and important public pages.
4. Confirm that recent backups exist and that the recovery contact still knows what to do.

Every quarter, test a backup restoration, review connected services and access tokens, inspect the hosting plan's security features, and remove anything no longer needed. Revisit this process before seasonal campaigns or other periods when traffic and business impact are higher. Hosting dashboards, browser requirements, CMS recommendations, authentication methods, and vulnerability guidance can change, so review the provider and platform documentation at least every six months or after a major platform change.

Save this checklist with your website records and note the date, person responsible, findings, and follow-up action. Security becomes easier to maintain when each review produces a small, documented next step rather than waiting for a serious problem.