Security best practices: an SME baseline
A realistic baseline that most small-business sites can reach in a day or two with their developer or host.
Last reviewed: 2026-10-18
Recommended headers (starting point)
Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: default-src 'self'; frame-ancestors 'self'; upgrade-insecure-requests X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Permissions-Policy: camera=(), microphone=(), geolocation=()
Tune the CSP to the scripts you actually use. Test in Content-Security-Policy-Report-Only first. Add preload to HSTS only once you're sure every subdomain supports HTTPS.
Baseline checklist
- HTTPS everywhere; HTTP redirects with a 301
- MFA on the CMS, hosting, domain registrar and email admin accounts
- Unused plugins, themes and admin accounts removed; updates applied monthly
- Off-site backups, restored and tested at least quarterly
- Admin logins and changes logged, with alerts for new admin users
- Third-party scripts listed, reviewed and loaded only after consent where needed
- Subresource Integrity on scripts loaded from CDNs
- Session cookies set with
Secure; HttpOnly; SameSite - SPF, DKIM and DMARC published (guide)
- A
/.well-known/security.txtwith a contact for vulnerability reports
Find out what your website reveals
Run the free passive mini-scan in under a minute, or ask for a quote for the full report.