Cybersecurity
Website security starts with access, not another plugin
Accounts, updates, forms and ownership: a practical security foundation your business can maintain.
Start with the access inventory
List the accounts that control your domain, hosting, email, CMS, repository and payment services. Give each an owner and a recovery route. A former collaborator’s account can remain a problem even when the website looks immaculate. Remove access that is no longer needed and check which addresses receive recovery messages. Treat the domain and email accounts as part of the website, rather than separate administrative details.
Individual accounts and an extra check
Avoid sharing a single password across a team. Individual accounts let you revoke one person’s access without interrupting everyone else. Use unique passwords, a password manager and multifactor authentication where supported. Protect recovery codes. Passkeys or security keys can reduce phishing risk on compatible services, but suspicious requests still need to be checked. Decide in advance who can recover an account when the usual owner is unavailable.
Updates need a recovery route
Assess important updates, test them on a separate copy and check essential journeys afterwards. For a shop, include baskets, payment and notifications. Have a recoverable backup before changing the system. Indefinite delay accumulates risk, while updating without checks can cause an avoidable interruption. Assign responsibility for watching alerts, approving a release and responding if it fails.
Follow the information submitted through forms
A protected form validates input on the server and keeps secrets out of the browser. Request size limits and abuse controls complement access restrictions; a hidden field alone is not a complete strategy. Ask for a demonstration of where an enquiry is saved, who can read it and what the customer sees if its email notification fails. Security checks should cover the actual workflow.
Make the review repeatable
Keep a short checklist covering active access, outstanding updates, recoverable backups and incident contacts. Review it after a supplier change or a colleague’s departure. The objective is reduced risk and organised recovery, rather than an impossible promise that a website can never be attacked.