Website Security Checklist for Australian Businesses
Most business owners don’t think about website security until something has already gone wrong: a defaced homepage, a warning from Google, an email from a customer asking why the site is sending them strange links. By then it’s a cleanup job, not a checklist.
This is the version to work through before that happens. It’s split into what your host should already be doing for you, and what’s genuinely yours to manage, and it sits alongside the rest of GoodHost’s security and backups guides if you want more detail on any one item.
Short answer: Cover five areas: SSL on every page, current backups you’ve actually tested, software kept up to date, strong unique passwords with two-factor authentication where offered, and a hosting environment that isolates your account from others on the same server. Miss any one and the rest matters less.
Is SSL actually set up correctly across the whole site?
Every page needs to load over HTTPS, not just the checkout or contact form, and the padlock showing in the browser isn’t the same thing as confirming there’s no mixed content quietly loading insecurely underneath. A partially secured site still shows security warnings to visitors on the pages that aren’t covered.
Free SSL certificates that auto-renew remove the most common failure mode, which is a certificate quietly expiring because nobody was tracking the renewal date. GoodHost’s cPanel plans include a free SSL certificate that renews automatically, which is worth confirming is actually active if you’re not sure. If you want the background on what SSL is actually doing, what is an SSL certificate, and do you need to pay for one covers it properly.
Are backups current and have they actually been tested?
A backup schedule that’s never been tested is a plan, not a safety net. The only way to know a restore will actually work when you need it is to have done it once already, in a low-stakes moment, rather than for the first time during an emergency.
- Backups running on a schedule that matches how often the site changes
- More than one recent backup retained, not just the latest
- Backups stored somewhere separate from the live server itself
- A restore actually tested at least once, ideally to a staging copy
GoodHost includes daily backups on cPanel plans, with JetBackup handling restores directly through the control panel. If you want the full process for doing a restore properly, including testing it before it goes live, see how to restore a website from backup.
Is the site’s software actually up to date?
Outdated software is one of the most common ways a site gets compromised, and it’s entirely preventable. CMS core files, themes and every plugin need updates applied promptly, not left for months because updating feels risky or inconvenient to schedule around.
The irony is that delaying updates because you’re worried they’ll break something usually increases risk overall, since the security gap sits open the whole time you wait. The safer sequence is: back up first, then update, then check the site still works. That order protects you either way.
| Area | What to check | How often |
|---|---|---|
| CMS core (e.g. WordPress) | Running the latest stable version | Check monthly, apply security patches promptly |
| Plugins and themes | No abandoned or unsupported ones installed | Review quarterly, update as released |
| Admin passwords | Unique, strong, not reused elsewhere | Immediately if reused, otherwise annually |
| User accounts | No former staff or old accounts still active | Review when staff change |
Are passwords and account access actually locked down?
Weak or reused passwords are a leading cause of compromised admin accounts, and they’re entirely within your control to fix regardless of what your host does. If the same password protects your website admin and three other accounts, one breach anywhere becomes a breach everywhere.
- Use a unique password for the hosting control panel, the CMS admin, and any FTP or database accounts
- Turn on two-factor authentication wherever it’s offered
- Remove access for anyone who no longer needs it, including former staff or contractors
- Avoid sharing a single shared login between multiple people where individual accounts are possible
A password manager makes unique passwords practical rather than a chore, and it’s a genuinely cheap fix for a problem that causes a disproportionate share of hacked sites.
Does the hosting environment itself limit the damage if something goes wrong?
On shared hosting, account isolation determines whether a security problem on someone else’s site can spread to yours. This is largely outside your control day to day, but it’s a legitimate thing to check when choosing or reviewing a host, because the underlying architecture either protects you or it doesn’t.
GoodHost’s cPanel hosting runs CloudLinux, which isolates each hosting account from others on the same server, alongside Imunify360 for active malware protection and daily malware scanning across accounts. Those aren’t things you configure yourself; they’re part of what the hosting environment is doing in the background, and it’s worth knowing they’re there rather than assuming every host works the same way underneath.
What should you do if you suspect the site has already been compromised?
Stop making changes and start documenting what you’re seeing: unexpected redirects, unfamiliar admin users, strange files, or a Google Safe Browsing warning. Acting fast matters, but acting in the wrong order can wipe evidence you’d otherwise use to find out how the attacker got in.
The full first-hour process, including what to check before you restore anything, is set out in my website has been hacked: what to do in the first hour. Working through that in order gives you a much better chance of closing the actual entry point rather than just cleaning up the symptom.
Frequently asked questions
How often should a small business review its website security?
A quarterly review of plugins, user accounts and backup testing is a reasonable baseline for most small sites, with security patches applied as soon as they’re released rather than waiting for the scheduled review.
Is shared hosting inherently less secure than a VPS?
Not necessarily, provided the shared environment properly isolates accounts from each other. The isolation technology matters more than the shared versus dedicated label itself.
Does having an SSL certificate mean my site is fully secure?
No. SSL encrypts data in transit between the visitor and the server, which is one piece of security, but it doesn’t protect against outdated software, weak passwords or malware already on the site.
What’s the single most common way small business websites get hacked?
Outdated plugins or themes with known vulnerabilities, combined with weak or reused admin passwords, account for a large share of compromises on small business sites.
Do I need a security plugin if my host already offers malware scanning?
It depends what the host-level scanning covers. Host-side scanning like Imunify360 works at the server level, which is a genuinely different layer of protection to an in-CMS plugin, and the two are complementary rather than duplicates.
If you’d rather see this checklist reflected in what’s actually included on a hosting plan than take it on faith, the security page lays out what comes standard on GoodHost’s cPanel hosting.