Website security checklist for Doha SMEs

Published 2026-10-18 · 6 min read · Samtaro Security & Legal

Qatar's PDPPL requires controllers and processors to take precautions proportionate to the nature and importance of the data they hold. For a small business, the website is usually where that starts.

Transport and headers

1. HTTPS on every page; HTTP redirects with a 301.
2. HSTS enabled.
3. A Content-Security-Policy, with frame-ancestors to prevent clickjacking.
4. X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy.

Access

5. MFA on the CMS, hosting, domain registrar and email admin accounts.
6. Individual admin accounts, with no shared logins; remove ex-staff and ex-agency accounts.
7. Rate-limited login pages.

Software

8. CMS, plugins and themes updated monthly; unused ones removed (OWASP A03:2025).
9. No public .git, .env or backup files.
10. Version numbers hidden from Server / X-Powered-By headers.

Resilience

11. Off-site backups with a tested restore.
12. Admin logins and changes logged, with alerts.

Email and vendors

13. SPF, DKIM and DMARC published (guide).
14. A list of the third-party scripts and vendors that handle customer data.
15. A security.txt contact for vulnerability reports.

Run the free mini-scan to check items 1–4, 10 and 13 in under a minute.

This article is for general educational purposes and is not legal advice. Seek qualified counsel for your specific situation.