Website security is not a one-click product. Combine supported software, controlled access, protected backups, monitoring and a response plan—and be honest that no setup removes all risk.
The short version
- Remove unsupported software and unused administrator accounts.
- Use unique passwords and multi-factor authentication where available.
- Keep restorable backups outside the live website account.
- Know who contains, restores and communicates after an incident.
Know what you are protecting
Create a short asset list: domain registrar, DNS, hosting, content-management system, plugins, third-party forms, payment tools, administrator accounts and backup location. Security work cannot cover an account nobody remembers exists.
- Domain and DNS
- Hosting control panel
- Website application and database
- Administrator and agency users
- Forms and connected services
- Backup destination
Reduce access risk
Use named accounts instead of one shared administrator login. Remove former staff and providers, apply the least privilege needed for each role and store recovery information securely. Enable multi-factor authentication on the registrar, hosting and website where supported.
Keep the software supportable
Apply security updates promptly, but keep backups and a rollback path for higher-risk changes. Remove plugins, themes and test copies that are not used. Replace abandoned components rather than trusting a scanner to protect them indefinitely.
Treat backups as a recovery system
Keep several recent copies, protect them from the same account compromise and test a restore. Record how long a full recovery is likely to take and who can authorise it.
- Automated schedule
- Multiple restore points
- Separate or protected storage
- Encrypted transfer where applicable
- Documented restore test
Prepare for the uncomfortable day
If an incident occurs, avoid repeatedly modifying the site before evidence and scope are understood. The response may include containment, credential changes, restoration, customer or regulator communication and specialist investigation. Keep the relevant provider and business contacts in the plan.
Relevant DigitalShift services
Need a view of your current setup?