A small local business website may look simple while connecting forms, booking, ecommerce, maps, analytics, advertising, email, payment providers, content management, and staff accounts. The review should follow data and authority across those boundaries. It should not assume that a hosting plan, HTTPS padlock, or plugin list proves the site is secure.
Map pages, data, and vendors
Inventory the public domain, redirects, subdomains, hosting, DNS provider, content management system, themes, plugins, forms, booking, chat, analytics, advertising pixels, maps, video embeds, payment links, and email delivery. Record the owner of each account, the data it receives, and the operational purpose. Use invented entries when testing forms and checkout-like flows.
The FTC guide to protecting personal information recommends taking stock of sensitive data and understanding how it moves. Trace names, email addresses, phone numbers, appointment details, location information, messages, order references, cookies, and device identifiers. Remove fields and trackers without a defined need, and keep sensitive details out of page source, analytics labels, URLs, and routine logs.
Secure administrative access
List every person, vendor, and service account that can change content, install code, export data, manage domains, or view submissions. Give each person their own account, minimize privileges, remove dormant access, and test offboarding. Require multifactor authentication wherever the service supports it, especially for domain, hosting, email, payment, and administrator accounts.
CISA's small-business cybersecurity resources emphasize phishing resistance, strong passwords, MFA, software updates, logging, backups, and encryption. Record whether each control is actually enabled, who monitors it, and the recovery path. A feature offered by a provider is not an implemented control until the configuration is verified.
Review forms and public inputs
For each form, record fields, purpose, required state, recipient, retention, spam controls, file uploads, success and failure behavior, and deletion path. Enforce length, type, and business rules on the server even when the browser also checks them. Avoid accepting arbitrary files unless the business needs them; restrict type and size, keep uploads outside executable locations, and provide a safe inspection process.
The OWASP Input Validation Cheat Sheet explains that client-side validation can be bypassed and recommends server-side, field-specific rules with bounds. MDN's input-validation guidance independently warns that front-end checks can be bypassed and that the server must validate before processing data. Test representative accepted and rejected values without attacking production. Check that error messages do not expose software internals and that logs do not copy unnecessary sensitive values.
Keep software and dependencies controlled
Record the supported versions of the platform, runtime, theme, plugins, libraries, and deployment tools. Identify who receives security notices, applies updates, verifies compatibility, and can roll back. Remove abandoned or unused components. Download software from authoritative sources and verify signatures or hashes when the publisher provides them.
Use a staging or controlled test path for consequential changes. Preserve configuration and content backups before updating, but never expose backups inside the public web root. Test the live site after release for forms, navigation, authentication, robots and canonical behavior, structured data, and external integrations. A successful homepage load does not prove that submissions arrive or restoration works.
Protect connections and browser behavior
Verify HTTPS on every route and redirect, inspect certificate coverage, and avoid mixed content. Review cookie attributes, session expiry, cross-site request protections, content restrictions, framing behavior, and security headers with qualified technical help. Ensure administrative interfaces are not needlessly public and rate-limit or otherwise protect abusive routes where the platform supports it.
The FTC's Start with Security guide recommends reasonable protections, limited access, secure disposal, and oversight of service providers. Apply that to website vendors and scripts. Record contract and support contacts, breach-notification paths, deletion options, and how the business disconnects a vendor without breaking the site.
Prepare detection, recovery, and honest communication
Enable logs that can show administrative changes, authentication events, form failures, deployment history, and unusual traffic without retaining full sensitive submissions unnecessarily. Define who reviews alerts and how a suspected compromise is contained. Keep an offline contact list and a tested restore procedure for content, configuration, and the database.
Check that public privacy, security, availability, and delivery claims match reality. Do not display trust badges or claims that are unsupported. If an incident affects forms or bookings, use an approved response plan and avoid speculative statements before facts are established.
Preserve a dated review record
The record should name the tested domain, date, account owners, data flows, vendors, software versions, access controls, form tests, update state, backup and restore result, logging, open risks, owners, and retest date. Separate externally observed behavior from private configuration evidence and vendor claims.
Prioritize fixes by potential harm and exposure: compromised domain or administrator access, leaked customer data, vulnerable public input, unsupported software, missing recovery, and misleading notices outrank cosmetic warnings. Repeat the review after vendor, plugin, form, payment, or account changes.
Sources
- Protecting Personal Information: A Guide for Business — Federal Trade Commission
- Small and Medium-Sized Business Resources — Cybersecurity and Infrastructure Security Agency
- Input Validation Cheat Sheet — OWASP Foundation
- Input validation — MDN Web Docs
- Start with Security: A Guide for Business — Federal Trade Commission