At minimum, protect administrator accounts, keep software supported, maintain tested backups, control DNS and hosting access, use HTTPS, validate inputs, restrict uploads, monitor changes, protect secrets, and have a clear response plan for suspicious activity.
Accounts and identity
Use unique administrator accounts, strong passwords, multi-factor authentication, least privilege, and a process for removing access when staff or contractors leave. Review third-party integrations that can act on behalf of your website.
Software and dependencies
Maintain a simple inventory of the CMS, frameworks, plugins, themes, libraries, server software, and external services the site relies on. Remove unused components and schedule updates instead of waiting for emergencies.
Hosting, DNS, and deployment
Protect registrar, DNS, hosting, CDN, repository, and deployment accounts with strong authentication. Limit who can deploy to production. Keep development and production environments separate and never expose private environment variables to client-side code.
Application controls
Validate data on the server, encode output for its context, use parameterized queries, control file uploads, rate-limit sensitive actions, and enforce authorization on every protected operation. Do not depend on hidden buttons or front-end checks for security.
Backups, logs, and monitoring
Keep multiple recovery points, test restore procedures, log important authentication and administrative events, monitor uptime, and alert on meaningful anomalies. Retention should be long enough to investigate an incident that is discovered late.
Review schedule
Run lightweight operational reviews monthly or after significant releases. Use deeper authorized security testing after major architecture changes, before high-risk launches, or when the system begins handling more sensitive business or customer data.