Website security checklist for Australian small business: 7 things to verify yourself

Website security for a small business is 7 checks, most of them free, none of them requiring a consultant - and this page is the checklist. Each item below explains what it is in one plain sentence, how to verify it yourself, why it matters, and what good looks like. The median Australian small business website scores 20/100 on the Security category - grade F^* - not because the fixes are hard, but because nobody ever handed the owner the list.

Why this list exists

Small business website security advice comes in 2 broken flavours. One end says "buy a penetration test" - thousands of dollars to have a professional attack a brochure site. The other says nothing at all, on the theory that small sites have nothing worth taking. Both miss what actually happens: small business sites get compromised in bulk, by automated scanners looking for the same handful of unlocked doors - and those doors are checkable from the outside, in an afternoon, by you.

The 7 items below are that list. Work through them in order; the first 4 are visible to anyone on the internet, including us, which is why our scan checks them automatically.

The checklist

1. HTTPS with a current certificate

Your site should load over an encrypted connection - the padlock - and the certificate behind it should be current and auto-renewing. Type your address with http:// in front: it should immediately redirect to https://. This is the most-passed item on the list, and still far from universal: 38% of Australian small business websites do not enforce HTTPS^*. What good looks like: every variation of your address - with and without www, http and https - lands on one encrypted page, and the certificate renews itself without anyone remembering to.

2. HSTS configured

HSTS is a one-line header telling browsers to refuse unencrypted connections to your site entirely - it makes the redirect from item 1 permanent in the visitor's browser. 7 in 10 Australian small business websites do not send it^*. Once your HTTPS has run cleanly for a while, HSTS is the follow-through; the cautious path is a short max-age first, raised once nothing breaks. What good looks like: the header present, a long max-age, and - for the ambitious - the domain submitted to the browsers' preload list.

3. Security headers present

Beyond HSTS, a small set of response headers tells browsers to enforce protections they otherwise skip: Content-Security-Policy controls what scripts may run (four in five Australian small business websites have no CSP at all^*), X-Frame-Options stops other sites embedding yours to trick clicks, Referrer-Policy keeps your visitors' browsing detail from leaking, and X-Content-Type-Options stops browsers reinterpreting files into something executable. Paste your address into Security Headers or Mozilla Observatory and you will have a graded answer in 30 seconds. What good looks like: a B or better, with CSP the item most worth the effort it takes.

4. SPF, DKIM and DMARC on your domain

These 3 DNS records authenticate email from your domain - they are the difference between your invoices arriving and a fraudster sending invoices that look exactly like yours. They live on the domain, not the website, which is why they belong on this checklist even though they feel like an email topic: the domain is the asset, and the web and email halves of it fail together. Check all 3 in one pass with MXToolbox. What good looks like: SPF ending in an enforcing qualifier, DKIM signing from every service that sends as you, and a DMARC policy that has graduated past p=none.

5. DNSSEC where your registrar supports it

DNSSEC signs the DNS answers that direct customers to your site and mail, so they can be verified rather than taken on trust. 98% of Australian small business domains do not enable it^* - we wrote a whole piece on why, and what we did about our own domains. What good looks like: if your registrar includes it free, it is on; if your registrar charges for it, you have read that piece before paying.

6. No publicly exposed admin, config or backup paths

Automated scanners constantly probe every website for the same forgotten doors: /wp-admin pages with no rate limiting, .env and config files left readable, database dumps named backup.sql sitting in the web root, old phpinfo.php test pages. Try a few yourself against your own site - the login page especially. What good looks like: admin pages exist but demand strong credentials (and ideally 2-factor authentication), and nothing configuration-shaped or backup-shaped is reachable from a browser at all.

7. CMS and plugins on supported versions

Most small business sites run WordPress or a site builder, and most compromises of them walk through a plugin vulnerability that was patched months earlier. The check is one screen: your CMS dashboard's updates page. What good looks like: core, theme and plugins all current, auto-updates on for everything that supports them, and - the step everyone skips - plugins you stopped using actually deleted, not just deactivated.

What this checklist is NOT

Working through this list makes you harder to compromise than most of the Australian small business web. It does not make you "secure" in the absolute sense, and we want to be precise about the gap. This is not a penetration test - nobody has tried to break your custom code, your staff's passwords or your office wi-fi. It is not compliance - if a contract or regulator requires Essential Eight, ISO 27001 or SMB1001 evidence, that is a different exercise with different paperwork. And it covers your public-facing surfaces, not your laptops, your backups or your people - for those, the Australian Cyber Security Centre's small business guide is the canonical free resource, and its advice on multi-factor authentication and backups belongs on your list right after this one. If you suspect you need the genuine adversarial article, Red Bridge Cyber vs penetration testing is honest about where a scan stops and a pen-tester starts.

What we don't do

We are not a penetration testing firm, and this checklist is not a funnel pretending otherwise. We do not break into systems, test staff, or certify compliance. When a customer's situation genuinely calls for a full penetration test, we refer them to partners who do that work - and take no referral fee for it, as our partner & referral disclosures set out. What we do is the outside view: our scan checks items 1 through 5 of this list continuously and reports them in plain English, which for most Australian small businesses is the affordable version of the only question that matters - is the public-facing basics list actually done, and does it stay done?