The One-Time Setup Checklist Every Website Should Pass

This is the boring stuff you only want to do once — but if it’s skipped, it’s usually why sites get hacked, crash, or become impossible to recover.

We recommend that you ensure your new site follows these basic initial setup tips.  If your site is already running, how many of these did you fail to do?  Now is the perfect time to review.

1. Hosting & access basics

• Separate hosting login and CMS admin (never reuse passwords)

• SSH / SFTP access confirmed and working

• Root / server access restricted to essentials only

• Emergency access details stored offline

2. Backups (non-negotiable)

• Automatic daily backups enabled

• Backups stored off-server (not just “on the same hosting account”)

• Manual backup tested once (restore actually works)

• Backup retention confirmed (not overwritten after 7 days)

3. File & user permissions

• Website files not owned by the web server user

• No 777 permissions anywhere

• Uploads folder writable, everything else locked down

• CMS admin accounts limited to people who really need them

4. Database setup

• Separate database user per website

• Database user has only required permissions

• No shared DB users across multiple sites

• Database credentials not hard-coded in public repos

5. Updates & version control

• PHP / runtime version explicitly set (not “latest”)

• Auto-updates configured or clearly disabled with a plan

• Theme and plugins documented (what’s installed and why)

• Version control in place if custom code exists

6. Security essentials

• SSL installed and auto-renewing

• Admin URLs protected (rate limiting, 2FA, or IP rules)

• Basic firewall or security plugin active

• File change monitoring enabled

7. Monitoring & alerts

• Uptime monitoring enabled (external service)

• Email alerts tested once

• Disk space monitoring active

• Expiry reminders set for domains and SSL

8. Recovery readiness

• Hosting provider contact details saved

• DNS provider clearly identified

• One-page “how to restore this site” note exists

• Someone other than the developer knows where this info lives

9. Performance sanity check

• Caching enabled and verified

• Image sizes sensible (no raw camera uploads)

• Page loads tested on mobile and desktop

• Obvious errors removed from logs

Final thought

Most website disasters aren’t caused by attacks or bugs — they’re caused by missing setup.

Complete this checklist once, document it, and you’ve already avoided about 80% of real-world website emergencies.