Website security is not a product that can be installed once and forgotten. It is a collection of ordinary decisions that make common attacks harder, limit the damage when something fails and make recovery possible.
No responsible provider can promise that a website will never be compromised. A more useful goal is to reduce avoidable risk and prepare a clear response.
Keep software and dependencies supported
Old content-management systems, plugins, themes and application packages can contain publicly known vulnerabilities. Remove components that are no longer required and keep the remaining software on supported versions.
Updates should be backed up and tested. Security is not improved if an uncontrolled update breaks the enquiry form or leaves the site unavailable.
Protect administrator accounts
Administrator access deserves stronger protection than an ordinary visitor account.
- Use a unique password created by a password manager.
- Enable multi-factor authentication where available.
- Avoid sharing one login between several people.
- Remove accounts that are no longer needed.
- Give each user only the permissions required for their work.
Do not use predictable usernames or leave temporary supplier accounts active indefinitely. Review who has access as part of regular maintenance.
Secure the hosting account too
Strong website passwords are not enough if the hosting control panel, domain registrar or email account is poorly protected. Those accounts may allow someone to replace the website, change DNS records or reset other credentials.
Use separate passwords and multi-factor authentication for the hosting provider, domain registrar, source repository and business email. Keep recovery information current and under business control.
Use HTTPS consistently
HTTPS encrypts information between the visitor and the website and helps confirm that the visitor reached the expected domain. Check that the certificate renews automatically and that HTTP addresses redirect directly to the secure version.
HTTPS does not prove that the website itself is safe. It is a necessary transport protection, not a complete security assessment.
Reduce unnecessary exposure
Every plugin, integration, upload form and administrator tool adds functionality and potential risk. Keep the system as simple as the business allows.
Disable unused services, remove abandoned plugins and restrict management interfaces where practical. Validate uploaded files and form data on the server, even when the browser already performs checks.
Back up independently
Security planning must assume that prevention can fail. Keep recent backups outside the live hosting account and verify that they can be restored.
Recovery from a clean backup may be faster and safer than trying to repair an unknown set of compromised files. Retain enough history to return to a point before the problem began.
Monitor for meaningful changes
Useful monitoring can include:
- website availability;
- unexpected file changes;
- failed administrator logins;
- newly created privileged accounts;
- malware or reputation warnings; and
- expiry of certificates or domains.
Alerts need an owner and a response. Collecting warnings without reviewing them does not reduce risk.
Handle personal data carefully
Collect only the information the business needs and avoid leaving customer details in multiple mailboxes or exports. Limit access to enquiry records and apply retention rules appropriate to the business.
Security and privacy overlap: reducing unnecessary stored data also reduces what could be exposed.
Prepare an incident checklist
If a problem is suspected:
- preserve evidence and avoid making random changes;
- restrict access or place the site in maintenance mode if necessary;
- change affected credentials from a trusted device;
- identify the likely entry point;
- restore or rebuild from a known clean source;
- update and test the recovered site; and
- consider legal or customer notification duties where personal data may be involved.
The exact response depends on the system and the incident. For serious cases, specialist security or legal advice may be required.
The practical foundation remains straightforward: supported software, protected accounts, minimal access, independent backups and someone responsible for checking that each control still works.