Checklist for CMS setup and maintenance
From first installation to ongoing safe operation
§At installation
- 01Is the core system installed in the latest supported version?
- 02Have standard passwords and example accounts been removed or changed?
- 03Are only the plugins/modules installed that the solution really needs?
- 04Has a working backup been made before making changes to production?
§Themes and plugins
- 01Does the theme/plugin come from a source with evidence of maintenance and updates?
- 02Has it been tested in a test environment before going live?
- 03Have unnecessary or unused themes and plugins been removed, not just disabled?
- 04Is it clear what permissions each plugin actually requests?
§Users and rights
- 01Does each user only have the rights their role requires (least privilege)?
- 02Have inactive accounts been cleaned up and access removed?
- 03Are access routes clear and is there slippery going to fight?
§PLACEHOLDER_3
- 01Is there a fixed routine for updating core systems, themes, and plugins?
- 02Are regular, tested backups taken — and are they stored somewhere other than the server itself?
- 03Is the site monitored for downtime and abnormal behaviour?
- 04Is there a plan for who responds if a security update is urgent?