Skip to main content

​
The Marketer’s Web Security Checklist

Answer honestly. “I don’t know” counts as a no — in security, not knowing is the finding. No technical skills needed; where you can’t answer yourself, forward the question to your agency or IT and judge how confident the answer sounds.

​
Area 1: Software & maintenance — who owns your code?

  • I can name the specific person or company responsible for updating our website — and they’d agree it’s their job.
  • Updates happen on a defined schedule (or automatically), not “when someone remembers.” (Median time to exploit: 5 hours.)
  • We have a current list of every plugin/extension on the site, and none of them is abandoned by its developer.
  • Every theme and plugin was bought from the official source with an active license. (Nulled software caused 17% of all WordPress infections.)
  • Our PHP / platform version is currently supported — someone has checked in the last 6 months.
  • If our site is a custom CMS: it has received a security-related update in the past year, and I know what it fixed.
  • An independent party (not the people who built it) has security-tested our site at least once.
  • Nobody has ever answered my security question with “it’s custom, so hackers don’t know it.”

​
Area 2: Access & ownership — who holds the keys?

  • I can list everyone who can log into our CMS, hosting, and domain registrar — and justify each one.
  • Every ex-employee and ex-agency has had their access removed. I’ve checked, not assumed.
  • Everyone has an individual login. No shared “marketing@” account with a password in a spreadsheet.
  • Two-factor authentication is enforced on the CMS, hosting, and domain registrar. (88% of web-app breaches use stolen passwords.)
  • Only people who truly need it have admin rights — content editors are editors, not admins.
  • I know exactly who controls our domain registrar account, its renewal date, and the recovery email is a monitored inbox.
  • We (the company, not the agency) own our domain, hosting account, and a copy of the site’s source or export.
  • Our agency contract actually mentions security: response times, breach notification, backups, and what happens if we part ways.

​
Area 3: Protection & recovery — what happens on the worst day?

  • Our site sits behind a protective layer (a CDN/WAF like Cloudflare) — it’s not exposed directly to the internet. (37% of all traffic is malicious bots.)
  • Our forms have spam protection, and real leads aren’t drowning in bot submissions.
  • Backups run automatically and are stored somewhere other than the same server as the site.
  • Someone has performed a test restore in the last year — we know the backup actually works. (31% fail when it counts.)
  • Someone is alerted before our SSL certificate or domain expires — by a system, not by memory.
  • Something (or someone) monitors our site for malware, defacement, and Google blocklisting. (93% of infected sites are never flagged by search engines.)
  • We have a one-page plan for the first 24 hours after a hack: who we call, who takes the site down, who tells whom.
  • Management has seen our security status at least once — it’s a business topic, not a hidden marketing chore.

​
Your score

Count your no’s and don’t-knows. 0–3: Solid — you’re ahead of most companies; close the gaps and put a yearly review in the calendar. 4–8: At risk — you’re running on luck; pick the three scariest no’s and assign each one an owner this week. 9+: Exposed — don’t panic, but treat this as a project with a deadline. The good news: you now have the exact list of what to fix, which is more than most companies ever get.

​
Closing thoughts

Here’s the thing this checklist really measures: not technology, but ownership. Every no you counted is a question with no name attached to it. That’s fixable — and fixing it is mostly meetings and decisions, not code. At Expirio, we solved it for ourselves by removing the problem instead of managing it: we build on Webflow, where there are no servers to secure and no plugins to update, with Cloudflare filtering the bots before they ever reach the site. You don’t have to switch platforms tomorrow — you just need to know where you stand. Today, you do. If you haven’t yet, watch Josh’s video that goes with this article. Send your no’s to whoever runs your website and ask one question: whose name is on this? And if you want to go deeper — we’re running four hands-on workshops for marketing teams this fall. This is the first piece of what Expirio Insights is here for: the knowledge nobody gave you with the job.