Account review

  • Every user has an individual account.
  • Administrator access is limited and justified.
  • Inactive users are disabled or removed.
  • Passwords are unique and securely stored.

Technical review

  • HTTPS works across the complete platform.
  • PHP and server software are supported and updated.
  • Production error details are not publicly displayed.
  • Secrets are absent from public files and repositories.
  • Upload folders cannot execute scripts.

Recovery review

  • A recent backup exists.
  • The backup is stored securely.
  • The restore process has been tested.
  • Incident contacts and responsibilities are known.
Recommended frequency

Complete this review before launch, after major updates and at least once each month.