Website security checklist for small businesses: late 2026

If you only have an afternoon for website security this quarter, spend it on five things: protect every admin login with passkeys or two-factor authentication, apply security updates within days rather than weeks, keep off-site backups you have actually restored, monitor uptime and certificate expiry, and review which third parties can touch your site. These checks apply whether you run WordPress, Shopify, Webflow, HubSpot, Magento or a custom build.

The 2026 data explains why these five matter most. This article is general information, not security or legal advice for your specific setup.

What the 2026 attack data says

Several large reports published this year point the same way:

• Exploited vulnerabilities now lead. Verizon's 2026 Data Breach Investigations Report found exploitation of vulnerabilities was the initial access route in 31% of breaches, while abuse of credentials fell to 13%. Only 26% of critical vulnerabilities in CISA's Known Exploited Vulnerabilities catalogue were fully remediated in 2025, and the median time to fully remediate rose to 43 days.
• Third parties are involved in nearly half of breaches. The same report says third-party breaches feature in 48% of breaches, and ransomware was involved in 48% of the breaches analysed.
• Stolen passwords are everywhere. Cloudflare's 2026 threat report says bots account for 94% of login attempts it observes, and 46% of human login attempts use credentials already exposed in earlier breaches. It also warns that stolen session tokens give attackers access to already-authenticated sessions, bypassing MFA.
• Plugins are the weak spot for WordPress. Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, with 91% in plugins and 9% in themes. It found 46% had no patch available at the time of disclosure, and for heavily exploited flaws the weighted median time to first exploit was 5 hours.

Attackers are moving faster than monthly maintenance cycles. Your patching and login security need to keep up.

1. Lock down admin logins with passkeys or 2FA

Passkeys are now mainstream. The FIDO Alliance estimated in May 2026 that 5 billion passkeys are in use worldwide, and that 68% of organisations have deployed or are deploying them for employee sign-ins. Because a passkey is tied to the real site, it resists phishing in a way passwords and SMS codes do not.

Check every account that can change your website, not just the CMS:

• Website platform or CMS admin accounts.
• Hosting control panel and server access.
• Domain registrar and DNS provider. Whoever controls DNS controls your site and email.
• The email accounts used to reset all of the above.
• Payment, analytics, tag manager and form tools.

For each one: turn on passkeys where supported, otherwise an authenticator app or hardware key rather than SMS. Give every person their own login, remove former staff and agencies promptly, and sign out all sessions when someone leaves, since a stolen session can outlive a password change.

2. Patch within days, not weeks

Who handles updates depends on your platform:

Practical rules for self-hosted and custom sites:

• Review security updates at least weekly and apply critical ones within a few days.
• Delete plugins, extensions and apps you no longer use. Deactivated code can still be a risk.
• Check your runtime. At the time of writing (November 2026), PHP 8.2 reaches end of security support on 31 December 2026, and Node.js 20 left security support on 30 April 2026.
• Consider a web application firewall or virtual patching service for the gap between disclosure and a fix.

3. Keep backups you have actually restored

A backup only counts if you can restore it. A sensible baseline:

• Automatic daily backups of files and database, stored off-site, away from your hosting account.
• At least 30 days of history, so you can go back to before a quiet compromise.
• A test restore to a staging site every quarter, timed so you know how long recovery takes.
• For hosted platforms, regular exports of products, CMS content, customers and form submissions, plus copies of theme or template code.

4. Monitor uptime, certificates and domains

TLS certificates are getting shorter-lived. Under a CA/Browser Forum ballot, the maximum validity of public certificates fell to 200 days from 15 March 2026, and it is scheduled to drop to 100 days in March 2027 and 47 days by March 2029. Manual renewal will not keep up, so make sure renewals are automated.

Do not rely on your certificate authority to warn you either. Let's Encrypt, for example, stopped sending expiry reminder emails in June 2025. Set up:

• Uptime monitoring that checks key pages every few minutes and alerts more than one person.
• Certificate expiry alerts, at least two weeks ahead.
• Domain renewal set to auto-renew, with a valid payment card and a monitored contact email.

Cloudflare also reports that DDoS attacks it observed more than doubled in 2025 to 47.1 million, with most lasting under 10 minutes. If your site matters to revenue, check what DDoS protection your host or CDN includes.

5. Review third parties and scripts

With third parties involved in almost half of breaches, list everything with access to your site: agencies, freelancers, plugins, apps, marketing scripts and integrations. Remove what you no longer use, give each vendor its own account with the minimum permissions, and keep a simple record of which scripts load on checkout and form pages.

Frequently asked questions

Is a hosted platform like Shopify or Webflow automatically secure?

The vendor handles platform updates and infrastructure, which removes a lot of risk. Account security, staff access, apps and integrations are still your responsibility.

Is SMS two-factor authentication good enough?

It is much better than a password alone, but passkeys, authenticator apps and hardware keys resist phishing and SIM-swap attacks better. Use them where available.

How often should these checks happen?

Updates and backup checks weekly, an access review and test restore quarterly, and monitoring running continuously.

What to do next

Pick one item from each section and do it this month: switch your registrar and CMS admin to passkeys or app-based 2FA, remove one unused plugin or app, run a test restore, confirm certificate renewal is automated, and remove one old vendor login. Then put the weekly and quarterly checks in a shared calendar so they keep happening.

Sources: Help Net Security on the Verizon 2026 DBIR, Help Net Security on Cloudflare's 2026 threat report, Patchstack State of WordPress Security in 2026, FIDO Alliance, World Passkey Day 2026, CA/Browser Forum ballot SC-081v3, Let's Encrypt, PHP supported versions, Node.js end of life dates.