Website Security Checklist for Small Businesses: 20 Steps After PHP2Shell
Updated 24 October 2026.
When the PHP2Shell fixes landed on 21 October 2026 (explained), attack attempts surged from tens of thousands to millions within hours. Businesses on well-run hosting barely noticed. Businesses whose sites nobody maintained had a stressful week.
Here are 20 practical steps, grouped so you can work through them in an afternoon.
Ownership and responsibility
1. Know who hosts your website. Name, plan type (shared, managed, VPS) and login. Check your invoices or ask your developer.
2. Know who maintains it. A named person or company who can patch the same day when something like PHP2Shell happens.
3. Own your accounts. Domain, hosting, website admin, Google and Meta accounts should be in your business's name, not a freelancer's. See domain, hosting and business email explained.
Software versions
4. Run a supported PHP version (8.3 or newer recommended). PHP 8.2 ends on 31 Dec 2026. Check yours and see all PHP end-of-life dates.
5. Keep WordPress core updated (or your CMS or framework). Turn on automatic minor and security updates.
6. Keep plugins and themes updated, and delete unused ones.
7. Remove abandoned and nulled software. Plugins not updated in a year or more, and pirated "free premium" themes, are a leading cause of hacked sites.
Hosting and infrastructure
8. Choose hosting that patches fast and communicates clearly. See what hosts did for PHP2Shell.
9. Use a CDN or WAF (for example Cloudflare). Edge rules can block known attacks while patches roll out.
10. Use HTTPS everywhere, with automatic certificate renewal.
11. If you run a VPS, automate security updates and document how to restart PHP and web services (VPS patching guide).
Access and accounts
12. Strong, unique passwords for every admin, hosting and email account, stored in a password manager.
13. Two-factor authentication on hosting, domain registrar, website admin, email, Google and Meta accounts.
14. Least privilege. Give staff and agencies only the access they need, and remove access when people leave or projects end.
15. Protect the admin area. Limit login attempts; consider restricting /wp-admin or your admin URL by IP if your team works from fixed locations.
Backups and recovery
16. Automatic daily backups, stored off the server (not only on the same hosting account).
17. Test a restore at least once, and after any major change. A backup you can't restore isn't a backup.
Monitoring
18. Uptime monitoring with alerts to your phone or email (free tools exist).
19. Watch for warning signs: Google Search Console security issues (setup), hosting malware alerts, unexpected admin users, spam pages in Google. See signs your site was hacked.
Planning
20. Write a one-page incident plan:
- Who decides and who acts (names and phone numbers)
- How to put up a maintenance page or take the site offline
- Where backups are and how to restore them
- Which passwords and keys to rotate
- Who to inform: customers, your host, and where required CERT-In (CERT-In's PHP2Shell advisory and reporting) and data protection obligations under the DPDP Rules (checklist)
Don't forget forms and customer data
Your lead forms collect names, phone numbers and emails. Protect them:
- Send form data to a trusted service or CRM, not just an inbox anyone can access
- Use spam protection (honeypots, CAPTCHA where needed)
- Only collect what you need, with clear consent (required under the DPDP Rules)
- Limit who can export customer lists
A quick self-score
Give yourself one point for each step done:
| Score | What it means |
|---|---|
| 17–20 | Well protected. Keep it routine |
| 11–16 | Decent, with gaps. Fix the missing items this month |
| 0–10 | At risk. Start with steps 1, 2, 4, 16 and 13 this week |
Where we fit
We build websites for businesses in Bangalore and Shivamogga with security built in: supported software, fast-patching hosting, CDN and WAF, backups, monitoring and accounts in your name. We can also review an existing site against this checklist. See website development, website design in Shivamogga and why websites don't get enquiries.
Want a quick security review of your site? Get in touch.
Sources
Wbzard Labs
Want this done for your business?
We help founders in Bangalore and Shivamogga launch with a website, social media, SEO and ads that work together. Tell us about your business and get a free launch plan.