The Security Basics Most Websites Skip

Website security gets discussed as though the threat is a determined attacker studying your business. Usually it is an automated script finding a known vulnerability in something you forgot was installed.

Know what is actually running

You cannot secure what you have not listed. Every plugin, theme, library and integration, with its version and whether it is still maintained. Most sites we audit are running at least one thing nobody remembers adding.

Patch on a schedule

The gap between a vulnerability being published and being exploited is now measured in days. “We update when we remember” is not a schedule.

Remove access nobody needs

Old freelancer accounts, shared logins, administrators who only ever needed to edit a page. Review who has access twice a year and remove everyone who does not need it.

Test that the backup restores

A backup you have never restored is an assumption. Restore it to a staging environment and confirm the site actually comes back. This is the single most commonly skipped step, and the one that matters most on the worst day.

Turn on the boring things

Two-factor authentication for administrators. HTTPS everywhere with HSTS. Rate limiting on login. Disabling file editing from the dashboard. None of it is interesting and all of it works.

Know what you would do

Decide in advance who to call, where the backups are and who can take the site offline. Working that out during an incident wastes the hours that matter most.