Ravindra BagaleCourses & study guides मराठी Track your progress

Free Cyber Security Tools

Website Security Checklist (Interactive + PDF)

By Last updated:

Quick answer: keep software updated, use HTTPS, protect logins with 2-step login, close extra ports, check form input, and keep tested backups. Tick the 23 items below as you finish them.

How to use this checklist

Why

Most small websites are hacked through simple gaps: an old plugin, a weak password, or an open port. A checklist makes sure you do not forget one.

What

There are 23 items in 6 groups. Your ticks are saved in this browser, so you can come back later. You can also print it or download the PDF.

How

  1. Start at group 1 and go down in order.
  2. Do the fix, then tick the box.
  3. Come back next month and check again.
  4. Share the PDF with your developer or hosting team.

Example, step by step

  1. Anita runs a small bakery site in Nashik on WordPress.
  2. She ticks group 1 and finds 3 plugins she never uses.
  3. She deletes them and updates the rest.
  4. The site now has 3 fewer ways in.

✔ Your ticks are saved only in this browser (localStorage). Nothing is sent to any server.

Updates and software

HTTPS and headers

Logins and passwords

Server and network

Code and forms

Backups and monitoring

Download PDF

Example: hide the nginx version (item 10)

Why

If your server shows its exact version, attackers can look up known bugs for that version.

What

nginx adds its version to error pages and the "Server" header by default. One line turns this off.

How

  1. Check now: curl -sI https://example.com | grep -i server.
  2. If you see Server: nginx/1.24.0, open your nginx config.
  3. Add server_tokens off; inside the http { } block.
  4. Test and reload: sudo nginx -t && sudo systemctl reload nginx.
  5. Check again. It should now show only Server: nginx.

Ravindra Bagale's Tip

Do the cheap things first: updates, 2-step login and backups. They stop most real attacks. Then set a monthly 15-minute reminder to go through this list again.

Frequently asked questions

Where are my ticks saved?

Only in your own browser, using localStorage. If you clear browser data or use another device, the ticks are gone.

How often should I check my website security?

Go through this list once a month, and again after any big change like a new plugin or a server move.

Is this checklist enough to be fully secure?

No checklist makes a site 100% secure. It covers the most common gaps. For important sites, also get a professional security test.

Can I use the PDF with my team?

Yes. Download it, print it, and share it with your developer or hosting company.

  1. 7. Apache and Nginx: Install and Understand
  2. 13. Multiple Websites on One Server and HTTPS with Certbot
  3. 20. Vulnerability Scanning and Assessment
  4. 21. Web Application Testing Tools
  5. 30.4 Protecting Data: S3, Encryption and Secrets
  6. All free Cyber tools