The key website security measures are the same for a five-page brochure site and a busy online shop. Lock down who can log in, patch everything promptly, encrypt traffic, put a firewall in front of the site, keep tested backups, and watch your logs so you notice trouble early. Each measure is cheap compared with the cost of a hacked site. They only work when someone owns them month after month, which is why many businesses hand the routine to a team that builds and hosts websites for a living, as we do at Brainiac Media.
This guide walks through each measure in order of impact, draws on guidance from government security bodies, and shows where sites most often slip.
No single product secures a website. Attackers look for the weakest link: a forgotten admin login, an out-of-date plugin, an unvalidated form field. Official guidance reflects that. CISA’s website security guidance spans the domain and DNS records, user accounts, vulnerability scanning, encryption, backups and application hardening. The Australian Cyber Security Centre boils it down to HTTPS, strong passwords, appropriate access controls, regular backups and up-to-date software and plugins.
The UK’s National Cyber Security Centre adds an operational view. Security is something you run, not something you install once, because it depends on knowing what normal looks like so you can spot what is not.
The sections below turn that guidance into a working list.
Stolen or guessed credentials are one of the easiest ways into a site, so start here.
CISA advises enforcing MFA, particularly for privileged accounts and anything reachable from the internet. The Australian Cyber Security Centre specifically names website administrator accounts. Your Europe, the EU’s business guidance, also points to proper authentication such as MFA as a way to protect confidentiality.
Apply it to your CMS admin area, hosting control panel, domain registrar, email accounts and any third-party tools connected to the site. An attacker who owns your registrar login can redirect your entire domain, so that account matters as much as the CMS.
CISA also recommends least privilege: disable accounts and permissions that are not needed and change default usernames and passwords. In practice:
A quarterly review of user lists takes ten minutes and closes a surprising number of doors.
Out-of-date CMS software, plugins and server components are a common route to compromise, because known flaws are published and attackers scan for them automatically.
CISA’s guidance is to scan continuously for vulnerabilities on internet-facing systems and fix critical ones within 15 days and high ones within 30. It also recommends enabling automatic updates where possible and replacing hardware and software that no longer receives support. The Australian Cyber Security Centre gives the same message in plainer terms: keep software, devices and plugins current.
A workable routine for a small business:
The common failure is not ignorance but nobody being responsible. Updates pile up behind a launch, a campaign or a holiday. Our website maintenance checklist sets out a recurring schedule you can adopt, and our piece on common website pitfalls covers the mistakes that tend to follow neglected updates.
HTTPS encrypts data moving between your visitors and your server, protecting logins, form entries and payment details from interception. CISA recommends disabling plain HTTP, enforcing HTTPS and enabling HSTS, which tells browsers to only ever connect securely, and preloading HSTS where possible. Your Europe also lists encrypted connections as a core confidentiality measure.
What the padlock does not tell you is whether the site itself is trustworthy or well built. Mozilla explains that HTTPS provides privacy and encryption for the connection but does not guarantee the site will not try to scam you. For your own business, that means HTTPS is the minimum, not the finish line. A site with a valid certificate can still run vulnerable plugins or weak admin passwords.
Our explainer on SSL certificates covers how certificates work and how to keep them from lapsing, which is a surprisingly common cause of browser warnings that scare customers away.
A web application firewall (WAF) filters malicious requests before they reach your application. CISA recommends WAFs alongside content delivery networks and load balancing, which also help the site stay available under heavy traffic. McGill University’s web services team advises protecting internet-facing services with a proxy and a WAF, and separating the presentation, application and database tiers so a breach of one layer does not hand over everything.
For a small or medium-sized business, the practical questions are:
The last two are where firewalls often fail: installed, then forgotten. This is one reason we offer hosting and IT infrastructure management alongside website development, so that the environment the site runs in is looked after as part of the same engagement.
SQL injection and cross-site scripting (XSS) both come from the same root: a site trusting what visitors type. A search box, contact form or comment field becomes a way to run an attacker’s code in your database or in other visitors’ browsers.
CISA’s recommendations are specific:
These are development tasks. They are far cheaper to build in from the start than to retrofit, so brief them in when you commission a site: parameterised database queries, output encoding, validated file uploads and secure session handling. Our article on common website vulnerabilities and their impact explains how each type of attack plays out for a business.
For forms, a bot-filtering layer helps reduce spam submissions and automated abuse. Our small business guide to improving website security covers it with other quick wins.
You cannot fix what you have not found. CISA recommends continuous scanning for critical and high vulnerabilities, including configuration weaknesses, with fixes prioritised using the OWASP Top 10. Your Europe goes further on integrity: carry out daily checks for altered files, plan security testing for websites and services, and consider an intrusion prevention system.
A sensible layering for most businesses:
Performance and security monitoring overlap, since a sudden slowdown can be the first sign of abuse. Our article on website performance monitoring shows how to set up the kind of tracking that makes anomalies visible.
Backups are what turn a disaster into an inconvenience. CISA recommends backing up critical website data and system configurations automatically and continuously, keeping backup media in a safe, physically remote location, and testing disaster recovery. The Australian Cyber Security Centre likewise says to back up website data regularly.
Three habits separate a useful backup from a false comfort:
The NCSC says effective monitoring starts with understanding what normal activity looks like, then watching logs and other sources for anomalies, which can help you stop an incident before it does lasting damage. The Canadian Centre for Cyber Security advises defining a monitoring strategy covering network traffic and failed connection attempts, with logs analysed and the right people notified promptly.
McGill’s guidance is concrete about what to log: web server and application logs, authentication activity, privilege changes and suspicious behaviour, with a retention policy. CISA adds that logs should be sent to a central log server, so an intruder cannot simply erase their tracks on the compromised machine.
For most small businesses the aim is modest: alerts for repeated failed logins, new admin accounts, changed files and traffic spikes, going to someone who will actually read them.
A perfectly patched site is still exposed if the domain is hijacked. CISA’s guidance starts with the domain ecosystem: review registrar and DNS records, change default credentials, enforce MFA on registrar accounts and monitor certificate transparency logs for certificates issued that you did not request. Make sure the registrar account is registered to a role-based business email rather than one employee’s inbox, and that renewals are not tied to an expired card.
When a site is defaced or infected, hesitation is expensive. Your Europe says incident response procedures should state who has lead responsibility, how to reach critical personnel, which data and services are recovered first and who must be notified if data is exposed. McGill recommends a ready plan and being prepared to isolate compromised areas and alert key contacts.
The Anti-Phishing Working Group’s hacked website response report sets out a typical sequence:
It also advises having logs ready (web server, firewall, operating system) plus copies of any unauthorised content and a timeline. The Australian Cyber Security Centre recommends reviewing sites for suspicious activity and reporting incidents. If you are in the UK and customer personal data may have been exposed, you also need to consider your obligations to report to the Information Commissioner’s Office, so name who decides that in your plan.
If you are starting from scratch, work through this order over a few weeks:
Most of the hacked sites we hear about were not defeated by clever attacks. They fell to an old plugin, an unused admin account or a backup that had never been tested. The measures above are not complicated, but they are relentless: they need doing every month, by someone who has the access and the time. That is why we treat security as part of how a site is built and run, not an add-on at the end. Secure development, careful hosting and infrastructure management and ongoing web support belong in one plan, owned by one team, so that nothing falls between a designer, a developer and a hosting provider. If you are a business owner, the best question to ask about your site is not whether it has a padlock. It is who is responsible for patching, backing up and monitoring it this month. Rob
Most of the hacked sites we hear about were not defeated by clever attacks. They fell to an old plugin, an unused admin account or a backup that had never been tested. The measures above are not complicated, but they are relentless: they need doing every month, by someone who has the access and the time.
That is why we treat security as part of how a site is built and run, not an add-on at the end. Secure development, careful hosting and infrastructure management and ongoing web support belong in one plan, owned by one team, so that nothing falls between a designer, a developer and a hosting provider.
If you are a business owner, the best question to ask about your site is not whether it has a padlock. It is who is responsible for patching, backing up and monitoring it this month.
Rob
Security measures only protect you when they are applied consistently. Brainiac Media builds websites, including bespoke, e-commerce, WordPress and CMS-based projects, and offers website hosting and IT infrastructure management as a service. You can see the full list on our services page, or get in touch to talk through your site.
We operate internationally, with offices in the UK, South Africa, Australia and the US, and we work with small and medium-sized businesses as well as larger organisations.
Look for HTTPS and a valid certificate, which show the connection is encrypted. That is only part of the picture: Mozilla notes that HTTPS does not guarantee the site itself is trustworthy. For your own site, confirm the software is up to date, admin logins use MFA and backups are tested.
If you can only do one thing, enable MFA on every administrator account and keep software patched. Both CISA and the Australian Cyber Security Centre place authentication and updates at the heart of their guidance, because stolen logins and known vulnerabilities account for so many compromises.
Apply security fixes as soon as you can test them. CISA’s timelines are 15 days for critical vulnerabilities and 30 days for high ones on internet-facing systems. Where possible, enable automatic updates and review everything at least monthly.
Contain it: isolate the affected areas, change credentials and keep logs and copies of any unauthorised content. Then recover from a clean backup and review the cause. Follow your incident plan, and if personal data may be exposed, consider your reporting obligations in the UK to the Information Commissioner’s Office.
Book a Demo
Forgotten Password
Get your free SEO guide
Thank you, please check your email
Sign into Brainiac Media
Please sign-in using your email address and password.
Forget your Password?
no worries, click here to reset your password.