Website Security Checklist 2026 — 50 Points to Verify

By Tibzi Team — 2026-03-03T14:47:19.139Z

This list contains 50 essential security points that every website should meet in 2026. We've grouped them into 8 logical categories, from the most critical to the recommended ones. Use it as a reference and check each point regularly.

SSL / HTTPS (7 points)

  1. Valid SSL certificate — issued by a recognized CA, with a complete certificate chain
  2. Certificate not expired — check the expiry date and set up automatic renewal
  3. TLS 1.2 or 1.3 — disable TLS 1.0 and 1.1 (deprecated)
  4. Forward secrecy enabled — ECDHE or DHE in the cipher suites
  5. Adequate key strength — at least RSA 2048 or ECDSA 256
  6. Secure ciphers — no RC4, DES, 3DES, NULL or EXPORT ciphers
  7. HTTP → HTTPS redirect — permanent 301 redirect on every URL

Check automatically: Tibzi SSL Check

HTTP Security Headers (8 points)

  1. Strict-Transport-Security (HSTS) — max-age=31536000; includeSubDomains
  2. Content-Security-Policy (CSP) — restricts the sources of scripts and other resources
  3. X-Content-Type-Options — nosniff
  4. X-Frame-Options — DENY or SAMEORIGIN
  5. Referrer-Policy — strict-origin-when-cross-origin
  6. Permissions-Policy — disables unused APIs (camera, microphone, geolocation)
  7. Cross-Origin-Opener-Policy — same-origin
  8. Cross-Origin-Resource-Policy — same-origin

Check automatically: Tibzi Security Check

Server Configuration (8 points)

  1. Server header hidden — doesn't reveal the Apache/Nginx/LiteSpeed version
  2. X-Powered-By removed — doesn't reveal the PHP/framework version
  3. Only the necessary ports open — 80 and 443 (optionally 22 for SSH)
  4. Database not reachable from outside — port 3306/5432 blocked to the public
  5. Directory listing disabled — Options -Indexes
  6. Sensitive files protected — .env, .git/, wp-config.php.bak, phpinfo.php not accessible
  7. WAF active — Cloudflare, Sucuri, ModSecurity or equivalent
  8. Regular backups — daily, stored off-site, tested periodically

Email Authentication (7 points)

  1. SPF configured — TXT record listing the authorized servers
  2. DKIM active — cryptographic signature on outgoing emails
  3. DMARC configured — at least p=quarantine, ideally p=reject
  4. MTA-STS active — enforces TLS for incoming email
  5. TLS-RPT configured — reports on email TLS failures
  6. BIMI configured — your brand logo shown in the inbox (optional but recommended)
  7. Valid PTR record — the mail server's IP has reverse DNS configured

Check automatically: Tibzi Email Check

CMS and Application (7 points)

  1. CMS up to date — WordPress, PrestaShop, Magento on the latest stable version
  2. Plugins up to date — every extension on its latest version
  3. Unused plugins uninstalled — not just deactivated
  4. Unused themes deleted — keep only the active theme and one default theme
  5. Admin panel protected — custom URL, 2FA, limited login attempts
  6. Correct file permissions — directories 755, files 644, wp-config.php 640
  7. Disable XML-RPC — for WordPress, if you don't use it

GDPR Compliance (8 points)

  1. Privacy policy — accessible, complete, up to date
  2. Working cookie consent — accept, reject, customize
  3. Cookies blocked until consent — non-essential cookies inactive by default
  4. Terms and conditions — reachable from the footer
  5. Company details visible — tax ID (CUI), Trade Register number, registered office, contact details
  6. ANPC link — mandatory for e-commerce in Romania (ANPC is Romania's consumer protection authority; check it with the audit tailored for online stores)
  7. SAL pictogram — ANPC's alternative dispute resolution pictogram, on the homepage, linking to reclamatiisal.anpc.ro (the ODR link is no longer required: the EU platform was shut down on July 20, 2025)
  8. Forms with consent — a checkbox to agree to data processing

Check automatically: Tibzi GDPR Check

Performance (6 points)

  1. LCP under 2.5 seconds — Largest Contentful Paint
  2. CLS under 0.1 — Cumulative Layout Shift
  3. INP under 200ms — Interaction to Next Paint
  4. Brotli/Gzip compression enabled — cuts transfer size by 70-90%
  5. Cache headers configured — static assets with an appropriate Cache-Control

Check automatically: Tibzi Performance Test

Accessibility (1 key point)

  1. WCAG 2.1 AA compliance — headings, alt text, ARIA, contrast, keyboard navigation

Check automatically: Tibzi Accessibility Test

How to Use This Checklist

  1. Run a free complete audit on Tibzi — it automatically covers ~35 of the 50 points
  2. Check the remaining points manually (CMS updates, backups, file permissions)
  3. Prioritize: fix the critical points first (SSL, ports, exposed files), then the important ones
  4. Repeat monthly — security is an ongoing process, not a one-off project