Website Security Checklist for Indian SMBs (2026)
Secure Indian SMB websites with 10 monthly checks, DPDP/RBI basics, backup rules, malware response, and attacks causing Rs 15K-50K cleanup costs.
- A hacked Indian SMB site costs ₹15,000-50,000 to clean plus 3-14 days of downtime, and Google flags it in search results while the ranking damage compounds.
- Outdated plugins are the attack vector in over 60% of WordPress compromises, so patch CMS and plugins within 7 days of release, and put 2FA on the CMS, hosting, DNS and email — weak admin credentials remain the single most common entry point.
- Free tools cover most of the risk: Let's Encrypt for HTTPS with an HSTS max-age of 31536000 once stable, Cloudflare's free WAF, which blocks around 90% of bot traffic, and login-attempt limits with an IP block after 5 failures.
- DPDP Act, 2023 adds obligations to the same checklist — explicit consent at form submission, a documented purpose for the data, easy unsubscribe, and breach notification within 72 hours.
A hacked Indian SMB website costs ₹15,000–₹50,000 to clean and 3–14 days of downtime — plus search ranking loss and customer trust damage. Most attacks aren't targeted; they're automated bots scanning for outdated plugins, weak admin passwords, and exposed APIs. Here's the 2026 security checklist every Indian business website should pass.
The 10 non-negotiables
- HTTPS with HSTS — Let's Encrypt is free, auto-renewing. Add HSTS header with max-age 31536000 once stable.
- Strong admin passwords + 2FA on CMS, hosting, DNS, and email. Use a password manager. "admin/admin" is still the #1 way Indian sites get compromised.
- Plugin and CMS updates within 7 days of release. Outdated plugins are the attack vector for 60%+ of WordPress hacks.
- Web Application Firewall — Cloudflare's free tier blocks 90% of bot traffic. Sucuri or Wordfence for WordPress-specific rules.
- Daily off-site backups with 30-day retention and a tested restore. Backups you haven't restored from are wishful thinking, not a backup strategy.
- Limit login attempts + IP block after 5 failed attempts. Stops brute-force password attacks cold.
- Disable unused features — XML-RPC on WordPress, default REST endpoints, file upload routes you don't use.
- Database backups separate from code. Same-server backups die when the server dies.
- Security headers — CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy. Test at securityheaders.com.
- Vulnerability scanning monthly via WPScan, Sucuri, or Snyk for non-WordPress stacks.
India-specific compliance signals
- DPDP Act, 2023 — explicit consent at form submission, documented purpose of data use, easy unsubscribe, breach notification within 72 hours. Fines up to ₹250 crore.
- RBI guidelines if you process payments — PCI DSS compliance, no card storage on your servers, tokenisation via Razorpay/Cashfree/Stripe India.
- SEBI rules for any financial-services site — disclaimers, risk warnings, KYC links.
- Privacy Policy + Terms linked in the footer of every page.
What attacks Indian SMB sites actually face
- Spam comment / form bots — 90%+ of inbound bot traffic. Add hCaptcha or Cloudflare Turnstile to forms. Free, effective.
- Brute-force admin login — automated tools test 1,000+ password combos. 2FA + IP block solves it.
- SQL injection on legacy PHP — old custom-built sites without prepared statements. If your dev says "we use mysql_query," you have a 2010 site running in 2026.
- Malicious plugins / themes from nulled (pirated) sources. Never install plugins from outside the official repo or paid marketplaces.
- Defacement and crypto-jacking — attackers redirect your site or inject crypto miners. Catches you out only via uptime monitoring + content checksum alerts.
The 60-minute monthly security pass
- Run plugin and CMS updates on staging, then production.
- Verify the latest backup restores cleanly to a test environment.
- Review Cloudflare or hosting logs for unusual traffic spikes or 4xx/5xx clusters.
- Run a malware scan via Sucuri SiteCheck or Wordfence.
- Review user list — remove ex-employees, contractors with stale access, demo accounts.
- Check Search Console → Security & Manual Actions for warnings.
We harden Indian SMB websites against bot attacks, automate backup verification, and run monthly security passes as part of our maintenance retainer. See our website services or share your URL for a free security scan.
What to verify before acting on Website Security Checklist for Indian SMBs
Rules and platform behaviour change after an article is published. Confirm LCP, INP, CLS, mobile performance, image delivery, and JavaScript loading constraints against the Core Web Vitals before you act on anything below, because the right answer depends on your entity, state, turnover, and current setup.
Going deeper: Website Design & Development.
Frequently asked questions
What is the cost of a hacked website in India?
A hacked Indian SMB website typically costs ₹15,000–₹50,000 to clean (malware removal, password resets, plugin audits) plus 3–14 days of downtime. Add search ranking loss (Google flags hacked sites in SERPs), customer trust damage, and possible data-breach notification obligations under the DPDP Act. Total real cost is usually 5–10× the cleanup fee.
How do I secure my WordPress website in India?
The 10 essentials: HTTPS with HSTS, strong admin passwords with 2FA, plugin and CMS updates within 7 days of release, a Web Application Firewall like Cloudflare or Wordfence, daily off-site backups with tested restore, login attempt limits with IP block, disabled XML-RPC and unused features, separate database backups, security headers (CSP, X-Frame-Options), and monthly vulnerability scans via WPScan or Sucuri.
Is the DPDP Act applicable to my small business website?
Yes if your website collects any personal data — contact forms, lead magnets, accounts, payment information. The Digital Personal Data Protection Act, 2023 requires explicit consent at form submission, documented purpose of data use, easy unsubscribe, and breach notification within 72 hours. Fines for serious violations go up to ₹250 crore. Add a privacy policy and consent banner; train staff on data handling.
How often should I update website plugins?
Within 7 days of release for security patches, within 30 days for feature updates. Outdated plugins are the attack vector for 60%+ of WordPress hacks. Run updates on a staging environment first, verify the site works, then push to production. Schedule a monthly maintenance window so updates don't pile up.
Let's talk about your business.
Tell us what you're working on and where you want to go. We'll put together a plan. No obligation, no sales pitch.
- Free 30-minute call
- A plan built around your goals
- No obligation, no pressure
- Your own account manager