Website security checklist for Canadian businesses: SSL, updates, backups, forms and PIPEDA breach reporting

A Canadian business website is reasonably secure when it runs on HTTPS, gets regular updates, limits admin access, keeps tested backups outside the host, collects only the personal information it needs and has a plan for a breach. If personal information is involved, PIPEDA expects safeguards that match its sensitivity, and since November 1, 2018 it requires reporting breaches that create a real risk of significant harm. This checklist is written for a small business site with forms, possibly a store, and no in-house security team.

Disclosure: some links in this guide are partner links. If you buy through them, MMIX may earn a commission; your price stays the same.

What PIPEDA asks of a website owner

PIPEDA, the federal privacy law for the private sector, applies to personal information collected in the course of commercial activity, with some provincial laws applying instead in certain cases (Quebec, Alberta and British Columbia have their own private-sector laws). One of its principles requires security safeguards appropriate to the sensitivity of the information: physical, organizational and technological.

The breach rules matter most for websites. If a breach of security safeguards involving personal information creates a real risk of significant harm, you must report it to the Office of the Privacy Commissioner of Canada, notify the affected people and keep a record of every breach (including minor ones) for 24 months. Quebec's Law 25 has similar duties for confidentiality incidents, reported to the Commission d'accès à l'information. This article is practical guidance; your lawyer confirms what applies to you.

The checklist in 8 steps

Step 1. Serve every page over HTTPS

Install an SSL/TLS certificate and redirect all HTTP traffic to HTTPS, including the www and non-www versions. Many hosts include a free certificate from Let's Encrypt with automatic renewal. If you need a certificate with validated company details or a warranty, a paid certificate such as those in Namecheap's SSL range is an option; a domain validation (DV) certificate covers what most small sites need. After setup, check that the certificate renews and that no page loads images or scripts over plain HTTP.

Step 2. Keep the software updated

Most small-business sites are compromised through outdated software: the CMS core, plugins, themes, or the server's PHP version. Turn on automatic minor updates, review plugin updates weekly or monthly, and remove plugins and themes you do not use. A plugin that has not been updated by its developer for a long time is a candidate for replacement.

Step 3. Lock down admin access

• Give each person their own account; never share one admin login.
• Use the lowest role that does the job: editors do not need administrator rights.
• Turn on two-factor authentication for the CMS, the hosting panel, the registrar and the DNS provider.
• Remove accounts of former staff, agencies and freelancers the day the work ends.
• Limit login attempts and consider restricting the admin area by IP if your team works from fixed locations.

Step 4. Set up backups you have tested

Follow the 3-2-1 idea: at least three copies, on two kinds of storage, with one copy outside the hosting account. Back up daily if the site takes orders or form submissions, keep several weeks of copies and test a restore at least once a quarter. A backup that has never been restored is an assumption.

Step 5. Collect less through forms, and protect what you collect

Every field in a contact or booking form is personal information you are responsible for. Ask only for what you need to reply. Protect forms from spam with a CAPTCHA or a similar check, send submissions over HTTPS, and decide where they end up: an inbox, a CRM, a spreadsheet. Set a retention period and delete old submissions. Never ask for health details, SIN numbers or full card numbers through a general contact form.

Step 6. Review third-party scripts and cookies

Analytics, ad pixels, chat widgets and embedded maps send visitor data to other companies. Keep a list of every script on the site, remove the ones nobody uses, and describe the rest in your privacy policy. Quebec's Law 25 requires tools that can identify, locate or profile a visitor to be turned off by default, so a consent banner is the practical choice if you serve Quebec visitors.

Step 7. Add monitoring and a web application firewall

Set up uptime monitoring and alerts for changes to core files, and turn on the web application firewall your host or CDN offers. Security plugins for WordPress can scan for malware and alert you about suspicious logins. Read the alerts; a monitor that emails a mailbox nobody checks gives no protection.

Step 8. Write a one-page incident plan

Decide in advance who is called when the site is hacked, who restores it, who decides whether the breach must be reported to the Office of the Privacy Commissioner and who informs customers. Keep the hosting, registrar and developer contacts in the same document, and keep a breach record template ready. Under PIPEDA you report as soon as feasible after deciding that a breach creates a real risk of significant harm.

What to check: common mistakes

• Backups stored only on the hacked server. Attackers and ransomware often delete or encrypt them.
• A privacy policy copied from another site. It must describe what your own site collects, which services receive the data and where it is stored.
• Form submissions in a shared Gmail inbox for years. Set a retention period and delete what you no longer need.
• Old staging copies. Test sites on subdomains with outdated plugins are a common entry point. Delete them or protect them with a password.
• Data location left out. If your host stores data outside Canada, say so in the privacy policy. Our hosting guide covers data location.

Domain security belongs on the same list: registrar two-factor authentication, domain lock and auto-renew. See what to do when a domain expires.

FAQ