Website Security Essentials in 2026: The Checklist That Prevents 95% of Attacks

What actually attacks small business websites in 2026

• Credential stuffing — bots trying leaked passwords against your login.
• Outdated CMS plugins — the single most common WordPress breach vector.
• Exposed API keys — pushed to public repos or shipped in client code.
• Form spam and abuse — cheap for attackers, expensive for you.
• Supply-chain attacks — a compromised npm package quietly exfiltrating data.

HTTPS and security headers (the free wins)

1. 1HTTPS everywhere with HSTS and preload — HTTP should 301 to HTTPS, never serve.
2. 2Content-Security-Policy — the single most effective XSS defense.
3. 3X-Frame-Options: DENY or CSP frame-ancestors — prevents clickjacking.
4. 4X-Content-Type-Options: nosniff — stops MIME-type confusion attacks.
5. 5Referrer-Policy: strict-origin-when-cross-origin — a sensible default.
6. 6Permissions-Policy — lock down camera, mic, geolocation unless you need them.

Authentication and access

• Never roll your own auth. Use a vetted provider (Supabase Auth, Clerk, Auth0, Cognito).
• Enforce 2FA on every admin account — SMS is better than nothing, TOTP is better than SMS, passkeys are best.
• Rate-limit login attempts and password reset endpoints.
• Store passwords with bcrypt or argon2 — never MD5, never SHA-256 alone.
• Use role-based access control — no one logs in as admin for daily work.

"The two cheapest security wins in 2026: strong headers and mandatory passkeys. Together they neutralize most opportunistic attacks."

Dependencies and supply chain hygiene

1. 1Automated dependency scanning (Dependabot, Snyk, or npm audit in CI).
2. 2Pin exact versions in your lockfile — no floating ^ ranges in production.
3. 3Review new dependencies before adding — check maintainer, downloads, last publish date.
4. 4Fewer dependencies is always safer. Delete anything you don't need.
5. 5Scan client-side bundles for accidentally shipped secrets before every deploy.

Backups, monitoring and incident response

• Automated daily database backups stored off-platform — test the restore quarterly.
• Point-in-time recovery for anything containing user data.
• Uptime monitoring with alerting — Better Stack, Pingdom, or UptimeRobot.
• Error tracking (Sentry) — you can't fix what you can't see.
• A one-page incident response plan: who to call, how to rotate secrets, what to communicate.