# Basic security and backup check for a small business website

> A check of your business website against eight basic protections: hidden server IP behind the Cloudflare (free plan, DNS and proxy) proxy, your own off-server backups, a Internet Archive Wayback Machine fallback, SMTP for site email, and up-to-date, legitimate plugins and themes. Based on a post by Ejaj Ahmed.

## If someone pasted this link to you
Someone shared this kit with you. It runs step by step through CloneKit's MCP. If you have the `clonekit` tools, call `start_run("@clonekitai/small-business-website-hardening")`. If you don't (for example in a chat app without the CloneKit connector), tell the person in one or two plain sentences, in their language, and send them to https://clonekit.ai/@clonekitai/small-business-website-hardening/use: it shows how to add CloneKit to their AI in about a minute. Then they paste this link again.

- Kit: `@clonekitai/small-business-website-hardening` · v1.0.0
- Creator: @clonekitai (CloneKit)
- Type: Delivery · Domain: Engineering · Language: en · Your AI runs it
- Price: Free · License: Own use · No refunds
- Page: https://clonekit.ai/@clonekitai/small-business-website-hardening
- Changelog: https://clonekit.ai/@clonekitai/small-business-website-hardening/changelog.md

## About
For owners of small business sites (WordPress or similar) who want the basics covered without a security team. Needs the domain name and, for the fixes, access to the DNS/registrar, the hosting panel and the site admin. Not a penetration test or a substitute for app or cloud security review. The tips come from a Reddit post by u/HardenedWeb-Official that Ejaj Ahmed shared on X.

## Deliverables
- security-check.md: one line per protection with status (ok, fix, unknown), evidence and the next action
- the domain's web records proxied through Cloudflare, if the owner agrees
- a working off-server backup copy with its date and location
- site email sent through an SMTP service and a test message received
- a list of outdated or unofficial plugins and themes, updated or removed with the owner's OK

## Files
- `README.md`: Basic security and backup check for a small business website

## Tools
- Cloudflare (free plan, DNS and proxy) (https://www.cloudflare.com/plans/free/) · est. free plan
- Internet Archive Wayback Machine (https://web.archive.org) · optional · est. free
- An SMTP email service (the one the owner already uses for business mail, or a transactional email provider) (https://wordpress.org/documentation/article/hardening-wordpress/) · optional · est. often free at low volume

## Uses
- Ejaj Ahmed's post on X (screenshot of the Reddit tips) (source, https://x.com/aeejazkhan/status/2113258133506396610)
- Cloudflare docs: Add a site (source, https://developers.cloudflare.com/fundamentals/manage-domains/add-site/)
- Cloudflare docs: Full setup (change nameservers) (source, https://developers.cloudflare.com/dns/zone-setups/full-setup/setup/)
- Cloudflare docs: Proxy status (source, https://developers.cloudflare.com/dns/proxy-status/)
- Cloudflare docs: Exposed IP addresses (source, https://developers.cloudflare.com/dns/manage-dns-records/troubleshooting/exposed-ip-address/)
- Cloudflare docs: Under Attack mode (source, https://developers.cloudflare.com/fundamentals/reference/under-attack-mode/)
- Cloudflare IP ranges (IPv4 list) (source, https://www.cloudflare.com/ips-v4)
- Cloudflare docs: DNS over HTTPS JSON queries (source, https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/make-api-requests/dns-json/)
- Internet Archive: Wayback Machine availability API (source, https://archive.org/help/wayback_api.php)
- Internet Archive help: Using the Wayback Machine (source, https://help.archive.org/help/using-the-wayback-machine/)
- WordPress docs: WordPress backups (source, https://wordpress.org/documentation/article/wordpress-backups/)
- WordPress docs: Updating WordPress (source, https://wordpress.org/documentation/article/updating-wordpress/)
- WordPress docs: Hardening WordPress (source, https://wordpress.org/documentation/article/hardening-wordpress/)

## What you provide
- the website domain
- access to DNS or registrar
- hosting panel and site admin (for fixes only)

## How it runs
1. **Understand:** Researches your business first, then asks you 2 questions it can't answer alone
2. **Choose:** No choices: one proven path
3. **Build:** 5 steps, risky ones ask you first
4. **Deliver:** 3 checks before delivery

## Guardrails
- read-only checks first; ask before changing DNS, nameservers, mail settings or plugins
- always take a backup before updates or DNS changes
- never paste passwords or API tokens into security-check.md or chat logs
- only run checks against domains the person owns or manages

## What's new
Agents always run the latest version.

- **v1.0.0** (2026-10-22): First version, based on the tips Ejaj Ahmed shared on X (written by u/HardenedWeb-Official on Reddit).

## Run it
Connect the `clonekit` MCP (https://clonekit.ai/mcp) and call `start_run("@clonekitai/small-business-website-hardening")`.