Website Security Checklist for Indian SMEs — 12 Things to Fix Before You Get Hacked

Why Indian SME websites are particularly exposed

India has over 63 million SMEs. A growing proportion have websites that handle customer enquiries, payments, bookings, or user accounts. Most were built quickly, often by freelancers or agencies, with security as an afterthought. CERT-In received over 1.39 million cybersecurity incident reports in 2023 — a significant proportion targeting SME-scale businesses. The attacks are not sophisticated. They are automated scans looking for common, preventable vulnerabilities. This checklist covers the 12 issues that appear most frequently in SME website audits — and every one of them is fixable without specialist expertise.

Source: CERT-In Annual Report 2023-24; Ministry of MSME, Government of India

The 12-point checklist

1. HTTPS on every page. Your entire site must be served over HTTPS, not just checkout or login pages. Any HTTP page can be intercepted. Check your SSL certificate is valid and not expiring in the next 30 days.

2. Security headers are configured. HTTP security headers — Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Strict-Transport-Security — tell browsers how to behave when loading your site. Missing headers are a common finding in audits and are a 10-minute fix on most hosting platforms.

3. Admin panels are not publicly accessible. WordPress admin pages at /wp-admin, cPanel at standard ports, phpMyAdmin — if these are reachable from the public internet, they are being scanned and brute-forced right now. Restrict access by IP, move to non-standard paths, or put them behind a VPN.

4. CMS and plugins are up to date. Outdated WordPress, Joomla, Drupal, and their plugins are the most exploited attack surface in SME websites globally. Check every plugin and theme. Remove anything not actively used. Enable automatic updates.

5. Passwords are strong and unique. Every admin account across your website, hosting, domain registrar, and related services should have a unique, strong password stored in a password manager. Shared passwords across services are a single point of failure.

6. MFA is enabled on critical accounts. Your hosting control panel, domain registrar, email provider, and any admin accounts must have multi-factor authentication enabled. This single control prevents the majority of account takeover attacks.

7. Cloud storage is not publicly exposed. If you use AWS S3, Google Cloud Storage, or Azure Blob Storage, check that no buckets or containers are publicly accessible. Exposed cloud storage containing customer data is a DPDP Act breach waiting to happen.

8. APIs have authentication and rate limiting. Public APIs without authentication and rate limiting can be scraped, abused, and used to exfiltrate data at scale. Every API endpoint that returns personal data must require authentication. Rate limiting prevents automated abuse.

9. Form inputs are validated and sanitised. Contact forms, search boxes, login fields — any input that gets processed by your server must be validated and sanitised to prevent SQL injection and cross-site scripting attacks. These are consistently in the top 10 web vulnerabilities globally.

10. Backups exist and have been tested. A backup you have never tested is not a backup — it is a hope. Verify that your website and database are backed up daily, that backups are stored in a separate location, and that you can actually restore from them.

11. You scan for vulnerabilities regularly. A one-time security review goes stale quickly. New vulnerabilities are discovered in common software every week. Automated vulnerability scanning gives you continuous visibility into your exposure without requiring manual effort.

12. You have a breach response process.Under India's DPDP Act, you are required to notify the Data Protection Board of a personal data breach. That means you need to know when a breach has occurred and have a process for responding. A simple documented playbook — who to contact, what to preserve, what to communicate — is the minimum.

Want automated scanning across all 12 of these areas for your Indian SME website?