Website security is an ongoing process. A secure baseline protects the accounts that control the site, encrypts traffic, keeps software patched, preserves recoverable backups, and gives you a plan for responding when something goes wrong.
The essential points from this guide, at a glance.
Use unique strong passwords and enable MFA for administrator accounts.
Use HTTPS and maintain valid certificates and secure connections.
Keep the CMS, plugins, themes, libraries, and server software patched.
Maintain tested backups and a clear recovery plan.
Limit privileges, monitor important changes, and prepare for incidents.
Detailed write-ups covering each part of this guide.
The most valuable website account is often the account that can change the site, install software, access customer data, or alter DNS. Use unique passwords, a password manager where appropriate, MFA, and least-privilege access. CISA recommends MFA for business systems and encourages stronger, phishing-resistant methods where available.
HTTPS uses TLS to protect traffic between the browser and the website. Make sure the certificate is valid, the site consistently uses HTTPS, and HTTP requests redirect appropriately. The padlock indicates a protected connection; it does not prove that the website itself is completely secure.
Security vulnerabilities can exist in the CMS, plugins, themes, frameworks, libraries, server software, and third-party integrations. Keep supported components updated, remove software you no longer use, and maintain an inventory of important dependencies. Before major updates, make sure you have a recoverable backup.
A backup is useful only if it can be restored. Maintain backups of the data and configuration that are important to the website, store copies in a way that reduces the chance that one compromise destroys every copy, and test restoration periodically. CISA recommends automatic and continuous backups for critical data and configurations and recommends separating backups from the main environment.
Not every person who edits content needs full administrator access. Give each account only the permissions required for its role and remove accounts when people leave or no longer need access. Review administrator and integration accounts periodically.
Security incidents often begin with stolen credentials. Train people to recognize urgent requests, suspicious links, unexpected login prompts, and unusual messages. Monitor important website changes, new administrator accounts, password resets, DNS changes, and unusual traffic when your platform supports those alerts.
Decide in advance who controls the domain, hosting, CMS, backups, analytics, and email. Keep recovery contacts available. If the site is compromised, you need to know how to restrict access, preserve useful evidence, restore a clean version, rotate credentials, and communicate with affected providers or customers.
At least monthly, review administrator accounts, MFA status, software updates, backup health, certificate status, security alerts, unusual logins, and third-party integrations. Remove unused accounts and components. For a higher-risk site, increase monitoring and involve an appropriately qualified security professional.
CISA's small-business guidance emphasizes phishing awareness, strong passwords, MFA, software updates, logging, backups, and encryption. Google Search Central recommends HTTPS as part of a secure and usable website experience. Sources: CISA small and medium business resources and Google Search Central guidance.