An email program security checklist protects the things that make email valuable: your subscriber list, your sending domain and your accounts. This week's PHP2Shell patches, covered in our PHP2Shell guide, showed how quickly a web-server flaw can threaten a newsletter business. Use the checklist below to get ahead of the holiday peak.
What you will learn:
- Which accounts and keys need the strongest protection
- How to secure forms, websites and DNS
- How to monitor authentication and spot abuse
- What an incident plan should contain
The Short Version
- Turn on multi-factor authentication for your ESP, registrar, DNS and website admins.
- Use separate, least-privilege API keys and rotate them.
- Patch the CMS, plugins and PHP versions behind your forms.
- Publish SPF, DKIM and DMARC and read the reports.
- Keep an incident plan with contact names and first steps.
Direct answer: protect access first (MFA, least privilege), then reduce the attack surface (patching, form protection), then watch for abuse (DMARC reports, bounces, complaints), and write down what you will do if something goes wrong.
1. Accounts and Access
| Item |
Action |
Owner |
| ESP logins |
MFA on, unique passwords, remove stale users |
Marketing lead |
| Domain registrar |
MFA, registrar lock where available, correct contacts |
IT or founder |
| DNS provider |
MFA, restricted edit access, change alerts |
IT |
| Website admin |
MFA, no shared logins |
Developer |
| Agencies and freelancers |
Named accounts, expiry dates, offboarding |
Marketing lead |
Review the user list in each system every quarter and after any team change.
2. API Keys and Integrations
- Create one key per integration so you can revoke one without breaking everything.
- Grant minimum permissions; a form tool rarely needs permission to export the full list.
- Store keys in a secrets manager or environment variables, never in public code, page templates or chat messages.
- Rotate keys on a schedule and after exposure or staff changes.
- Remove integrations you no longer use.
3. Websites, Forms and Tracking Links
- Patch your CMS, plugins and server runtime, including PHP where relevant.
- Use bot protection and rate limits on sign-up forms to avoid junk and list-bombing.
- Use double opt-in where it fits; it reduces fake sign-ups and spam traps. See spam traps and list hygiene.
- Serve all forms and links over HTTPS.
- Audit redirect and tracking code for open-redirect behaviour.
- Test links before each send with the link verifier.
4. Domain Authentication and Monitoring
- Publish SPF for every service that sends on your behalf.
- Enable DKIM signing and check alignment.
- Add DMARC starting at monitoring, then move towards enforcement as legitimate senders align.
- Read aggregate reports for unknown sources.
- Check blocklists and reputation regularly.
Use the authentication health check, DMARC record generator, blacklist checker and sender reputation checker. For more on DMARC, see our DMARC RFC article.
5. Data Handling
- Collect only the data you need.
- Limit who can export lists; log exports.
- Encrypt backups and restrict their access.
- Delete data you no longer have a reason to keep.
- Document your consent and retention rules and check them with the GDPR compliance checker.
Worked example: the value of access control
A team of 10 each has export access to a 60,000-contact list. If export is limited to 2 named people, the number of accounts that can leak a full list falls from 10 to 2, a 80% reduction ((10 − 2) ÷ 10 = 0.8). If each account has an illustrative 3% chance of being compromised in a year, the chance that at least one export-capable account is compromised drops from about 1 − 0.97^10 = 26.3% to 1 − 0.97^2 = 5.9%. The probabilities are assumptions, but the principle holds: fewer powerful accounts means less risk.
6. Incident Plan
Write a one-page plan before you need it.
- Who is in charge and who is the backup.
- First actions: revoke keys, reset passwords, pause sending, preserve logs.
- Contacts: ESP support, host, registrar, legal or data protection adviser.
- Communication: who approves messages to customers and when.
- Recovery: how you restore from clean backups and confirm authentication.
Practice it once a year with a short tabletop exercise.
7. Phishing and Social Engineering
- Train your team to treat urgent “account suspended” or “patch now” emails with suspicion.
- Verify requests to change DNS or payment details by a second channel.
- Use a password manager and unique passwords.
Common Mistakes
- Shared logins with no audit trail.
- Never revoking former agency access.
- API keys in screenshots or documents.
- DMARC at monitoring forever with no one reading reports.
- No tested incident plan.
Security is boring until the week it matters; do the boring work before Black Friday.
Key Takeaways
- Protect accounts with MFA and least privilege.
- Rotate and scope API keys.
- Patch the software behind forms and tracking.
- Monitor DMARC, blocklists and complaints.
- Prepare an incident plan.
Sources and Further Reading
Related Articles
Related tools: authentication health check, DMARC record generator, blacklist checker, GDPR compliance checker.
Disclaimer: This article is general guidance, not security, legal or financial advice. All example figures and probabilities are illustrative.
