Guide

The Website Security Hardening Checklist

Optimization & Maintenance4 August 202616 pages

What you'll learn in this guide.

Your website is not being targeted by a sophisticated adversary; it is being scanned continuously by tooling looking for known vulnerabilities, weak credentials and exposed configuration. That distinction decides where effort is worth spending. This checklist works through six layers — access and identity, software supply chain, hosting, application hardening, data and compliance, and monitoring and response — with a 40-point audit list, an incident runbook outline, and a three-item shortlist for teams with no security specialist.

The four paths that account for most website compromises, and how to close each one
Why the domain registrar and DNS accounts matter more than the CMS login
How to build a software inventory and a patch cadence you will actually keep
The security headers worth setting, and how to roll out a Content-Security-Policy without breaking the site
Which data retention decisions remove risk permanently
The monitoring that turns a catastrophe into an incident
How to write a one-page incident runbook before you need it
The three things to do first if you can only do three

Inside the guide

Start with an honest threat model
Layer 1 — Access and identity
Layer 2 — Software supply chain
Layer 3 — Hosting and infrastructure
Layer 4 — Application hardening
Layer 5 — Data and compliance
Layer 6 — Monitoring, backups and response
The 40-point checklist
Where to start if you can only do three things

Practical hardening for business websites, ordered by how much realistic risk each layer actually removes.

We'll send it to your email.

The Website Maintenance Runbook
Most businesses do not have a maintenance problem, they have an ownership problem: nobody is accountable, so nothing is checked, and the first sign of trouble is a customer email. This runbook turns maintenance into a small number of named, scheduled, boring tasks across five categories — availability, security, performance, correctness and recoverability. It covers what should be monitoring without you, weekly, monthly, quarterly and annual routines, an incident runbook with severity levels, an ownership table and a one-page maintenance calendar.
16 pages · Optimization & Maintenance
The Lifecycle Email & Automation Playbook
Every other acquisition channel is rented; email is a list you own. The catch is that it only works if it lands, and mailbox providers now enforce what used to be best practice. This playbook starts with deliverability — authentication, subdomain warming, engagement-based sending and the complaint thresholds that decide whether you are delivered at all — then specifies the eight lifecycle flows in order of return, the segmentation worth its complexity, and a measurement model that survives inflated open rates. Includes a 90-day build order and a flow specification template.
16 pages · Digital Marketing
The Web Accessibility Compliance Kit
Accessibility became a compliance question in 2025 and 2026. The European Accessibility Act has applied since 28 June 2025 to businesses selling to EU consumers wherever they are based, and the DOJ extended the ADA Title II web deadlines in April 2026 to 2027 and 2028 without suspending the underlying obligations. This kit explains what the standards actually require, the ten failures that appear on almost every site, why overlay widgets do not solve the problem, how to audit properly when automated tools find only a third of real issues, and how to remediate in priority order. Includes a 30-point checklist and guidance on publishing an accessibility statement.
15 pages · Design, Development
The Google Ads Account Audit Workbook
Most Google Ads audits start with bids and end with a recommendation to increase budget. This one starts with whether the account is measuring anything real, because every recommendation downstream of a broken conversion signal is confident and wrong. Nine scored sections covering conversion tracking, structure, search terms, Performance Max and its 2026 controls, bidding, ads, landing pages, audiences and reporting — plus current benchmark medians from 13,474 US campaigns, an 18-point scorecard and a 90-day remediation plan.
16 pages · Digital Marketing
The B2B Website Redesign Playbook
Most B2B redesigns are judged on the wrong thing: the site looks better and, a year later, pipeline is where it was. Three failures account for nearly all of it — the project was scoped as a design exercise when the real problem was positioning, nobody protected the existing search traffic, and the site was designed for one buyer when the purchase is made by a committee. This playbook is structured to prevent all three, from the evidence-gathering week through positioning, architecture, the page system, asset protection, conversion design and a three-layer measurement model that survives a long sales cycle.
16 pages · Design
The Shopify Store Launch Checklist
A Shopify store can be trading in a fortnight, which is why so many launch with a broken tax setting, no redirect map and a pixel that fires twice. This checklist is organised by phase rather than by department, because the expensive mistakes are sequencing mistakes — decisions made after the build that should have been made before it. Ten phases from catalogue structure to the first thirty days, including the checkout extensibility deadlines that have now passed, and a one-page sign-off sheet nobody launches without.
16 pages · Development, Optimization & Maintenance
The Core Web Vitals Field Guide
Most Core Web Vitals work fails the same way: somebody runs Lighthouse, optimises for the score, and the field data never moves. This guide separates the two kinds of data, breaks each metric into the parts that can actually be fixed, and gives the remedies in the order they usually pay. It includes the current pass rates across 11.1 million origins, the commercial case from the Deloitte study, platform-specific notes for WordPress, Shopify and React frameworks, and a 25-point field checklist.
15 pages · Optimization & Maintenance, Development
The Technical SEO Audit Checklist
Most technical audits fail in one of two ways: they produce 200 findings nobody actions, or they check the easy things and miss the architectural problem doing the damage. This is the sequence we run instead — seven passes from indexation to internationalisation, each producing a small number of findings that either matter or do not, plus the six problems we see most often, a prioritisation model and a one-page reporting template. Written for in-house SEOs, marketing managers and developers who need an audit that ends in shipped fixes.
17 pages · Optimization & Maintenance
The E-commerce Conversion Optimisation Playbook
A working framework rather than a list of tips. It covers what to measure and why site-wide conversion rate is the least useful number you have, how to diagnose the reasons behind the drop-off using evidence you can gather in a week, the documented fixes that need no test at all, and how to work out whether your traffic can resolve an A/B test before you run one. Built for store owners, marketing managers and product teams who have plateaued and want to know where to spend the next month.
15 pages · Optimization & Maintenance, Design