Inventory what controls the website
List the domain registrar, DNS, hosting, content platform, email, analytics, forms, payment tools and third-party scripts. For each, record the business owner, administrator, support route, renewal date and recovery method. The inventory should be stored securely and available to authorized staff if the usual administrator is away.
Review the people and apps with access. Remove former staff, old contractors and unused integrations. Use named accounts, unique credentials and multifactor authentication where available. Avoid storing passwords alongside a public asset list; keep secrets in an approved password manager.
Check updates, backups and recovery
Clarify which software updates the platform provider manages and which plugins, themes, scripts or integrations remain the business’s responsibility. Apply supported updates through a tested process and remove components that are no longer needed. Keep an eye on provider security notices and account alerts.
Confirm that backups exist, are protected from the main administrator account and can be restored. A backup that has never been tested may not help during an outage. Record who can restore the site, where the recovery instructions are stored and which pages or business functions must be restored first.
Review public forms and information handling
Test contact and application forms for appropriate validation, spam protection, secure delivery and clear privacy information. Collect only the details needed for the stated purpose and restrict access to submissions. Confirm that messages are not sent to a personal mailbox that the business cannot recover.
Review any chat, analytics, advertising or embedded tools that collect information. Check current vendor terms, retention settings and the organization’s privacy practices. Legal obligations may differ based on the business and information involved; seek qualified privacy advice rather than assuming one checklist fits every Canadian organization.
Practice a simple response scenario
Ask what the team would do if the admin account was compromised, the domain stopped resolving, a form leaked customer details or a supplier payment was redirected. Identify the person who can contact the bank, hosting provider, email administrator and leadership. Preserve a factual incident timeline and avoid deleting evidence.
The Canadian Centre for Cyber Security publishes baseline controls for small and medium organizations that can help shape a wider review. Use it as a starting point, then adapt controls to your systems. A security review should end with assigned actions and dates, not a claim that the site is completely protected.
Practical checklist
- Inventory all accounts, owners, renewals, data flows and support contacts.
- Remove unused access and verify multifactor authentication.
- Test backup restoration and document recovery steps.
- Assign owners and dates to the issues found.
In short
Security improves through routine ownership, updates, tested recovery and a realistic incident plan. No checklist can promise zero risk.
This article is general educational information, not legal, privacy, cybersecurity or financial advice. Confirm requirements for your situation with a qualified professional.