A business website’s content gets attention: the pages, the photos, the product copy. Its infrastructure usually gets attention only when something breaks. Infrastructure is everything the site depends on that is not content. That means the domain name, the DNS, the hosting plan, the email, the backups, the security controls, and the legal obligations that sit on the site itself.
For a Canadian small or medium-sized enterprise, that last category is larger than most owners expect. Depending on the province and the business, a website may be subject to:
- Accessibility: Ontario’s accessibility standard, with a compliance report due on 31 December 2026 for businesses with 20 or more employees.
- Language: Québec’s requirement that commercial websites be available in French.
- Email: Canada’s anti-spam law for marketing email.
- Payments: the card industry’s payment-page security rules for anyone taking payments online.
- Privacy: federal and provincial privacy law for every contact form.
This checklist brings all of it into one place. It is organized into ten layers, each item has an owner and a review frequency, and each layer links to a more detailed guide where one exists. Use it once as an audit, then keep it as a quarterly review.
How to use this checklist
Each layer below has a short table: the item, why it matters, who usually owns it, and how often to check it. “Owner” is a suggestion, not a rule. In a five-person business the owner and the IT department may be the same person. What matters is that every item has a name next to it.
| Owner label | Who that usually is |
| Business owner | The person accountable for the business, who should hold the master credentials |
| Developer | An in-house or contract web developer or agency |
| Hosting provider | The company operating your server, confirmed in writing |
| Privacy lead | The person responsible for personal information under PIPEDA or provincial law |
The Canadian deadlines that affect this checklist in the next 18 months:
| Date | What is due | Checklist layer |
| 31 December 2026 | Ontario accessibility compliance report (businesses and non-profits with 20+ employees) | Layer 7 |
| 31 December 2026 | PHP 8.2 reaches end of life | Layer 2 |
| 15 March 2027 | SSL/TLS certificate maximum lifetime falls to 100 days | Layer 3 |
| Pending | Bill C-36, which would replace PIPEDA’s privacy rules, is before Parliament | Layer 6 |
Diagram of ten website infrastructure layers for Canadian SMEs, from domain and DNS to documentation and ownership
Layer 1: Domain name and DNS
The domain is the single most important asset in the stack. It is also the one most often registered to the wrong person. A domain registered in a former employee’s or developer’s personal name belongs to them, not to the business.
| Checklist item | Why it matters | Owner | Frequency |
| The domain is registered in the business’s legal name, with a business email as the contact | Ownership disputes are slow and expensive | Business owner | Once, then at any staff change |
| Auto-renew is on, with a valid payment method and a renewal date in the calendar | An expired domain takes the website and email down together | Business owner | Annually |
| The registrar account uses multi-factor authentication | Registrar access controls everything else | Business owner | Annually |
| A registrar lock (transfer lock) is enabled | Prevents unauthorized transfer to another registrar | Business owner | Annually |
| For .ca domains, the registrant meets CIRA’s Canadian Presence Requirements | .ca registrations require a qualifying Canadian connection | Business owner | At registration and ownership changes |
| DNS records are documented, including every service that relies on them | Needed for migrations, email authentication and troubleshooting | Developer | Quarterly |
| DNSSEC is enabled if your registrar and DNS host support it | Protects against DNS spoofing | Developer or hosting provider | Once, then annually |
Layer 2: Canadian web hosting plan and server
The hosting plan is where performance, cost and many security settings are decided. Most of these items are questions for your provider.
| Checklist item | Why it matters | Owner | Frequency |
| You know your plan’s renewal price, not just the introductory rate | Renewal rates are usually higher | Business owner | At each renewal |
| You know the plan’s resource limits (CPU, memory, storage, transfer) and overage terms | Limits cause slowdowns before they cause outages | Developer | Quarterly |
| The site runs on a supported PHP version (8.3 or later from 2027) | PHP 8.2 loses security support on 31 December 2026 | Developer | Twice a year |
| A staging copy is available for testing updates | Untested upgrades are the main cause of update-related outages | Developer | Before each major update |
| Uptime is monitored independently of the provider | You learn about outages before your customers do | Developer | Continuous |
| Server location, backup location and operator are confirmed in writing | Needed for privacy disclosures and Québec assessments | Privacy lead | Annually |
Our guide to [how hosting costs change as a Canadian website grows] explains how to read renewal and add-on pricing. The [Canadian web hosting trends] guide covers the PHP and certificate deadlines in detail.
Layer 3: Security controls
Most breaches at small businesses start with stolen credentials or unpatched software, not sophisticated attacks.
| Checklist item | Why it matters | Owner | Frequency |
| Multi-factor authentication on the hosting panel, CMS admin accounts, registrar and email | Unauthorized access drives most breaches reported to the federal privacy regulator | Business owner | Quarterly review |
| Every admin account belongs to a named current person, with no shared logins | Former staff and contractors often keep access | Business owner | Quarterly and at every departure |
| Unused plugins and themes are removed; active ones are updated | Plugins account for most CMS vulnerabilities | Developer | Monthly |
| Protection that does not depend on a patch existing (virtual patching or an application-aware firewall) | Many vulnerabilities are disclosed before a fix is available | Developer or hosting provider | Annually |
| SSL/TLS certificates renew automatically for every hostname | Certificate lifetimes fall to 100 days in March 2027 | Developer or hosting provider | Twice a year |
| Malware scanning is active and someone receives the alerts | Detection is only useful if someone acts on it | Developer or hosting provider | Monthly |
The data behind these items is in our [Canadian website security statistics] guide.
Layer 4: Email, domain authentication and anti-spam law
Business email usually runs on the same domain as the website, and it carries its own technical and legal requirements.
| Checklist item | Why it matters | Owner | Frequency |
| SPF, DKIM and DMARC records are published and include every service that sends as your domain | Required by Gmail, Yahoo and Outlook.com for bulk senders, and protects against impersonation | Developer | Quarterly |
| DMARC reports go to someone who reads them | Reports show who is sending as your domain | Developer | Monthly |
| Marketing email is sent only with consent that meets Canada’s Anti-Spam Legislation (CASL) | CASL requires consent, identification of the sender and a working unsubscribe mechanism | Business owner | At each list import and campaign |
| Unsubscribe requests are honoured promptly | CASL requires unsubscribes to take effect within 10 business days | Business owner | Continuous |
| Consent records are kept (date, source, wording) | The business must be able to prove consent if challenged | Business owner | Continuous |
| Mailboxes and email backups have a known location | Email holds more personal information than most websites | Privacy lead | Annually |
Layer 5: Backups and recovery
A backup that has never been restored is an assumption, not a plan. This layer is where small businesses are most often exposed.
| Checklist item | Why it matters | Owner | Frequency |
| Backups cover files, databases and email | Partial backups produce partial recoveries | Developer or hosting provider | Quarterly |
| At least one copy is stored off the server, in a separate facility | A backup on the same server is lost with it | Hosting provider | Annually |
| You know the retention period and how far back you can restore | Some compromises go unnoticed for weeks | Developer | Annually |
| A full test restore has been completed and timed | Tells you how long an outage would last | Developer | Twice a year |
| You have written down how much data loss (hours) and downtime (hours) the business can accept | Sets the backup frequency and recovery plan | Business owner | Annually |
| Backup locations are included in your privacy disclosures | Backups are copies of personal information | Privacy lead | Annually |
Layer 6: Data and privacy
Every contact form, customer account and analytics tool makes the website a privacy system.
| Checklist item | Why it matters | Owner | Frequency |
| A data-flow map lists every place website data goes (host, email, CRM, analytics, payments, chatbots) | You cannot disclose or protect what you have not listed | Privacy lead | Annually and at each new tool |
| The privacy policy matches the data-flow map, including locations outside Canada | Expected under PIPEDA; required in Alberta for service providers outside Canada | Privacy lead | Annually |
| For Québec customers, a privacy impact assessment is completed before data leaves Québec, including to other provinces | Required by section 17 of Québec’s private-sector privacy law | Privacy lead | Before each new transfer |
| A breach log exists and records every breach for 24 months | Required under PIPEDA, whether or not a breach is reportable | Privacy lead | Continuous |
| Your hosting agreement includes an incident notification commitment | You cannot meet notification duties if you are not told | Business owner | At each renewal |
| Progress of Bill C-36 is monitored | It would replace PIPEDA’s privacy rules and change enforcement | Privacy lead | Quarterly |
Our [data residency questions] guide lists 17 questions to put to your provider for this layer.
Layer 7: Accessibility and official languages
This is the layer most often missing from generic website checklists, because the obligations are provincial.
| Checklist item | Why it matters | Owner | Frequency |
| Ontario businesses with 50+ employees: public websites and web content meet WCAG 2.0 Level AA | Required under Ontario’s Integrated Accessibility Standards Regulation since 1 January 2021, with limited exceptions | Developer | At each redesign and annually |
| Ontario businesses and non-profits with 20+ employees: the accessibility compliance report is filed | The next report is due 31 December 2026 | Business owner | Every three years |
| Accessibility is tested with real tools and, ideally, real users, not only an overlay widget | Automated overlays do not by themselves make a site conform | Developer | Annually |
| Businesses with an establishment in Québec that target Québec customers: commercial website content is available in French on terms no less favourable than other languages | Section 52 of the Charter of the French language treats websites as commercial publications | Business owner | At each content update |
| French versions include checkout, terms, privacy policy and transactional emails, not just the home page | Partial translation leaves customer-facing commercial content in one language only | Developer | At each content update |
Even outside Ontario, WCAG 2.0 or 2.1 Level AA is the benchmark most accessibility complaints and procurement contracts refer to. It is a sensible target for any Canadian business website.
Card graphic showing website obligations by province: Ontario accessibility, Québec French-language and data-transfer rules, Alberta service-provider disclosure, and Canada-wide privacy, anti-spam and card-payment rules
Layer 8: Online payments
If the website takes card payments, the card industry’s security standard applies, whatever the size of the business.
| Checklist item | Why it matters | Owner | Frequency |
| You know which PCI DSS self-assessment questionnaire (SAQ) applies to your payment setup | The questionnaire determines what you must attest to | Business owner | Annually |
| If you use a hosted or embedded payment page from a processor, you can confirm your site is not susceptible to script attacks that could affect your e-commerce systems | Since 31 March 2025, this is an eligibility condition for the simplest questionnaire (SAQ A) | Developer | Annually |
| Scripts on payment pages are inventoried, authorized and monitored for changes, where your SAQ requires it | PCI DSS 4.0.1 requirements 6.4.3 and 11.6.1 target card-skimming scripts | Developer | Weekly monitoring; annual review |
| Card data never touches your own server unless your SAQ and controls cover it | Keeping card data off your server keeps most of the standard out of scope | Developer | At each checkout change |
The January 2025 change to SAQ A is widely misread as removing script security for small merchants. It removed two requirements from that questionnaire, but it replaced them with an eligibility condition covering script attacks on the site. The Payment Card Industry Security Standards Council said explicitly that the underlying requirements were not weakened.
Layer 9: Performance and monitoring
| Checklist item | Why it matters | Owner | Frequency |
| Core Web Vitals are checked for key pages on mobile | Page experience affects both visitors and search visibility | Developer | Quarterly |
| Caching and image compression are in place | Often recovers more speed than a plan upgrade | Developer | At each redesign |
| Bot traffic is visible separately from human traffic, and a crawler policy has been chosen | AI crawlers consume resources and distort analytics | Developer | Quarterly |
| Error logs are reviewed | Early warning of broken plugins and attacks | Developer | Monthly |
| Traffic peaks (holiday season, campaigns) are planned for | Most slowdowns happen at the busiest moments | Business owner | Before each peak |
Layer 10: Documentation and ownership
The final layer ties the other nine together. If the one person who knows how the website works leaves, this layer determines whether the business can carry on.
| Checklist item | Why it matters | Owner | Frequency |
| Credentials for registrar, hosting, CMS, email and DNS are held in a business password manager | Credentials in one person’s head or inbox are a single point of failure | Business owner | Quarterly |
| A one-page infrastructure summary lists providers, account numbers, renewal dates and support contacts | Speeds up every incident and every migration | Business owner | Twice a year |
| Contracts with developers state that the business owns the domain, code and content | Avoids disputes when relationships end | Business owner | At each contract |
| An offboarding step removes website access when staff or contractors leave | Former-user access is a common breach route | Business owner | At every departure |
| This checklist has a named owner and a review date | Checklists without owners stop being used | Business owner | Quarterly |
Choosing a hosting company that makes this checklist easier
Many checklist items depend on your provider. A hosting company can make them simple or make them harder, and it is worth checking how a provider handles them before you sign up or renew.
When comparing Canadian web hosting services, look for written answers on the items that sit with the provider:
- Automatic certificate renewal for every hostname.
- A choice of supported PHP versions and a staging environment.
- Backups off the server, with a known location, retention period and restore process.
- Help with DNS records, including SPF, DKIM and DMARC.
- A written statement of where data is stored and who operates the infrastructure.
- An incident notification commitment in the service agreement.
Well-run web hosting companies publish most of these in their documentation. For businesses that prefer Canada hosting for data residency, a Canadian web hosting company can also confirm that the website, databases, backups and email all stay in Canada. Keeping them there makes Layers 5 and 6 of this checklist shorter. The same review applies whether you are comparing Canada web hosting providers or reviewing the website hosting you already have. Choosing Canadian hosting settles the location questions; the rest of the checklist still needs an owner.
Frequently asked questions
What should be on a website infrastructure checklist?
A complete checklist covers ten layers. They are domain and DNS, the hosting plan and server, security controls, email and domain authentication, backups and recovery, data and privacy, accessibility and language, online payments, performance and monitoring, and documentation and ownership. Each item should have a named owner and a review frequency, so the checklist is maintained rather than completed once.
Does my Ontario business website have to be accessible?
Ontario businesses and non-profits with 50 or more employees must make their public websites and web content conform to WCAG 2.0 Level AA under the Integrated Accessibility Standards Regulation, with limited exceptions. Organizations with 20 or more employees must also file an accessibility compliance report every three years, and the next report is due on 31 December 2026.
Does my website need to be in French if I sell to Québec?
For businesses with an establishment in Québec that target Québec customers, the Charter of the French language treats websites as commercial publications. Commercial content must therefore be available in French on terms no less favourable than any other language. That includes checkout, terms and policies, not just the home page. Businesses without an establishment in Québec should seek advice on how the rules apply to them.
What does CASL require for business email?
Canada’s Anti-Spam Legislation requires consent before sending commercial electronic messages, clear identification of the sender, and a working unsubscribe mechanism. Unsubscribe requests must take effect within 10 business days. Businesses should also keep records of how and when consent was obtained.
Do small online stores need to worry about PCI DSS?
Yes. Any business that accepts card payments must comply with PCI DSS. Merchants who use a processor’s hosted or embedded payment page usually complete the simplest self-assessment questionnaire, SAQ A. Since 31 March 2025, qualifying for it requires confirming that the website is not susceptible to script attacks that could affect e-commerce systems.
How often should a small business review its website infrastructure?
Quarterly is a practical rhythm for most items, with some monthly tasks (plugin updates, error logs, DMARC reports) and some annual ones (restore tests, privacy policy review, domain ownership). Specific deadlines also apply: the Ontario accessibility report is due on 31 December 2026 and PHP 8.2 reaches end of life the same day.
Who should own the domain name for a business website?
The business itself, registered in its legal name, with a business email address as the contact and multi-factor authentication on the registrar account. Domains registered in a former employee’s or developer’s personal name belong to that person, which can make recovering them slow and expensive.
Key takeaways
- Website infrastructure is everything the site depends on that is not content, and every item needs a named owner.
- The domain name is the most important asset. Register it in the business’s name and protect the registrar account.
- Ontario businesses with 20+ employees must file an accessibility compliance report by 31 December 2026. Those with 50+ must meet WCAG 2.0 Level AA.
- Businesses with an establishment in Québec that target Québec customers must make commercial website content available in French.
- CASL governs marketing email, and email authentication (SPF, DKIM and DMARC) is now expected by major mailbox providers.
- Online stores must meet PCI DSS. The 2025 change to SAQ A kept script security as an eligibility condition.
- Backups count only once a full restore has been tested and timed.
- Many checklist items depend on the hosting provider. Get the answers in writing.
Conclusion
A website infrastructure checklist works when it is short enough to use and specific enough to act on. The ten layers here cover what a Canadian SME’s website depends on. That includes the technical foundations every site shares and the provincial obligations that only apply in Canada.
The fastest way to start is with the two layers most likely to be neglected: domain ownership and backups. Then work through the rest in order, and give each item a name and a date. Canadian web hosting can take care of the location questions and many of the technical items. What it cannot do is decide who in the business is responsible for each one. That part of the checklist belongs to you.
Next step
If you would like help working through the hosting-related items in this checklist, the 4GoodHosting team can review your plan, backups, PHP version and DNS records with you.