Website security is not one product; it is a set of habits plus a few well-chosen services. This checklist is the baseline we recommend to every Indian SMB running a business site. Work through it top to bottom — most items take minutes.
Access and passwords
- Use unique passwords of twelve characters or more for hosting, admin and FTP accounts — never reuse the email password.
- Enable two-factor authentication on the hosting panel and CMS admin.
- Delete old admin accounts of former staff and agencies immediately.
- Rename or protect the default admin login page to blunt brute-force attacks.
Software hygiene
- Update the CMS core, themes and plugins at least monthly.
- Remove deactivated plugins and unused themes completely; dormant code still gets exploited.
- Install software only from official repositories, never from nulled or pirated sources — these routinely ship with malware built in.
Encryption and transport
- Install an SSL certificate and force HTTPS on every page.
- Set a renewal reminder so the certificate never lapses; monitoring from Tech Guru Club can watch expiry for you.
- Use SFTP instead of plain FTP for file transfers.
Backup and recovery
- Run automated daily backups with CodeGuard, stored independently of your hosting.
- Test a restore quarterly; an untested backup is only a hope.
Active defence
- Add SiteLock malware scanning so infections are detected within hours.
- Put a web application firewall in front of the site to block attacks and virtually patch new vulnerabilities.
- Enable 24/7 uptime monitoring so outages are caught at any hour.
Review rhythm
- Monthly — updates and user review.
- Quarterly — restore test and permissions audit.
- Yearly — full security review with our team.
Want this checklist implemented for you? Open a ticket at app.techguru.co.in and ask for a website hardening review with INR pricing for each service.
