Security best practices: an SME baseline

A realistic baseline that most small-business sites can reach in a day or two with their developer or host.

Last reviewed: 18 October 2026

Recommended headers (starting point)

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'; frame-ancestors 'self'; upgrade-insecure-requests
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

Tune the CSP to the scripts you actually use. Test in Content-Security-Policy-Report-Only first. Add preload to HSTS only once you're sure every subdomain supports HTTPS.

Baseline checklist

  • HTTPS everywhere; HTTP redirects with a 301
  • MFA on the CMS, hosting, domain registrar and email admin accounts
  • Unused plugins, themes and admin accounts removed; updates applied monthly
  • Off-site backups, restored and tested at least quarterly
  • Admin logins and changes logged, with alerts for new admin users
  • Third-party scripts listed, reviewed and loaded only after consent where needed
  • Subresource Integrity on scripts loaded from CDNs
  • Session cookies set with Secure; HttpOnly; SameSite
  • SPF, DKIM and DMARC published (guide)
  • A /.well-known/security.txt with a contact for vulnerability reports

Find out what your website reveals

Run the free passive mini-scan in under a minute, or ask for a quote for the full report.

Run free mini-scanRequest a quote

Need help with an issue?

Quick contact Quick fixes Email support

Send the domain and finding reference. Please do not email passwords, customer records or exposed secrets. We reply within one business day; this is not a 24-hour incident-response hotline.