Free checklist
27-Point Website & Infrastructure Health Checklist
The list we work through before taking over any website or server. Twenty-seven yes/no questions across ownership, backups, monitoring, server health, security, WordPress and performance — each with what to check, why it matters, and the answer that should worry you.
It takes an afternoon to go through. Most businesses find a few gaps they didn’t know about, and one of them is usually backups. Written by the engineers who run hosting, WordPress and AWS environments for CloudWatch clients.
Ownership & access
5 checks
Backups, recovery & monitoring
6 checks
Server & platform
5 checks
Edge & security
7 checks
WordPress & email
2 checks
Performance & accessibility
2 checks
Get the full checklist
Enter your email and the checklist opens immediately — as a PDF and as a page you can tick off. You’ll also get one confirmation email; click it to receive the checklist by email and join the Infrastructure Brief (one practical email a week).
A preview
Three of the twenty-seven
Every item has the same shape: what “yes” means, why it matters, and the red flag. Here are three that come up on almost every site we look at.
#6
Backups run automatically and are stored off the server
What to check
Files and database are backed up at least daily (more often if the site changes more often), copied to different storage than the server itself, and kept for 30 days or more.
Why it matters
A backup on the same disk as the site disappears with the site. A backup from last quarter restores last quarter’s orders.
Red flag: "The host does backups" — with no idea where they are or how far back they go.
#13
PHP is a supported version and PHP-FPM is sized for the traffic
What to check
The PHP version still receives security updates. The PHP-FPM pool (worker count, memory per worker) matches the server’s RAM and real traffic, and PHP errors are logged somewhere reviewable.
Why it matters
Too few workers and requests queue up under load; too many and the server swaps. Both look like "the site is slow sometimes".
Red flag: PHP-FPM settings have never been changed from the defaults, or the PHP version is end-of-life.
#18
Cloudflare (or equivalent) is correctly configured
What to check
DNS records for the site are proxied, SSL mode is Full (strict), and the origin server only accepts traffic from the proxy — so protection can’t be bypassed by hitting the server IP directly.
Why it matters
A proxy that can be bypassed provides the feeling of protection without the protection.
Red flag: Cloudflare is "on" but the origin IP is public and answers directly.
Everything covered
All 27 points
DNS, SSL, hosting, backups, uptime monitoring, server resources, PHP, database, caching, CDN, Cloudflare, WAF, WordPress core/plugins/themes, admin security, MFA, malware and vulnerability scanning, logging, email deliverability, performance, mobile, accessibility, disaster recovery, staging, update procedures and documentation.
Get the ChecklistOwnership & access
- 1.You control the domain registrar account
- 2.DNS is hosted somewhere you can log into, and the records are documented
- 3.The TLS certificate is valid, automatic and complete
- 4.You know who hosts the site, what you pay, and who holds the login
- 5.There is one document listing every account and who has access
Backups, recovery & monitoring
- 6.Backups run automatically and are stored off the server
- 7.A restore has actually been tested
- 8.There is a written recovery plan for the likely disasters
- 9.External uptime monitoring alerts a human
- 10.A staging copy exists for testing changes
- 11.Updates follow a procedure, on a schedule, with an owner
Server & platform
- 12.Resource headroom is known and alerted on
- 13.PHP is a supported version and PHP-FPM is sized for the traffic
- 14.The database is healthy and its size is known
- 15.Caching is configured and verifiably working
- 16.Logs are retained, rotated and reviewable
Edge & security
- 17.Static assets are served through a CDN
- 18.Cloudflare (or equivalent) is correctly configured
- 19.A WAF and rate limiting protect the application
- 20.Admin access is hardened
- 21.Multi-factor authentication is on for every critical account
- 22.Malware and file-integrity scanning run on a schedule
- 23.Known vulnerabilities in plugins, themes and core are tracked
WordPress & email
- 24.Core, plugins and themes are current, licensed and pruned
- 25.Email from the site is authenticated and actually delivered
Performance & accessibility
- 26.Key pages pass Core Web Vitals
- 27.The site works on a phone and for people using assistive technology
Who this is for
Business owners, marketing leads and IT managers who are responsible for a website they didn’t build and don’t fully control. Agencies handing a site over. Anyone about to change hosts or take on a new client’s infrastructure.
If you go through it and want help closing the gaps, CloudWatch offers website management, managed hosting and AWS, and one-off infrastructure reviews. But the checklist is useful on its own, and most of it you can do yourself.