Assess your website’s security as a whole, from access and updates to HTTPS configuration and backups. Create a practical plan with your agency and technical team.
AccessPermissions, accounts and strong authentication.
ApplicationSupported versions and controlled updates.
BackupIndependent copies of files and databases.
RecoveryIncident records and tested recovery steps.
No single tool provides absolute security. Technical measures need an up-to-date inventory and clear allocation of responsibilities alongside them.
Grant only the permissions each task requires. Enable two-step verification on supported accounts; reduce shared passwords and revoke access for people who leave.
Track support status for operating systems, applications and plugins. Remove unused components; apply important updates with a backup and test plan.
Assess HTTPS, firewalls and application-level protection according to your needs. Create separate checkpoints for forms, login pages and exposed services.
Back up files and databases together. Keep copies independent of production and verify that backups can be restored, not merely that they were created.
Compare a security plan by the addresses to protect, actions to perform and results to verify, rather than product names. The areas below help identify needs; included service scope is clarified in your quote.
| Layer | What is it used for? | How do you verify its scope? |
|---|---|---|
| Malware scanning | Searching for suspicious content in files or web responses. | Scan scope, timing and findings record. Assess detection, cleanup and application repair separately. |
| WAF and rate limiting | Evaluating incoming HTTP requests to a web application using rules. | Protected domains, rule logs and a correction process for legitimate actions blocked in error. |
| DDoS and network protection | Planning filtering and capacity against traffic types that disrupt service. | Protected IPs / protocols, network and application layer coverage, limits and the incident procedure. |
| Vulnerability assessment | Checking for known vulnerabilities and configuration issues within an authorized scope. | Target list, method, date and rechecking findings after remediation. |
| Backup and recovery | Restoring data to working order from a suitable recovery point. | File/database consistency, retention and actual restore results. |
Separate client access; check that temporary permissions granted for one project do not extend to others. Record plugin licenses, the maintenance contact and access handover at the end of work for each client.
Add login, password reset, cart, payment return and API notifications to the critical workflow list. When a protection rule changes, verify these flows in an authorized test environment; a working homepage alone is not enough.
Define which incidents are reported to whom and how notifications are followed up. Keep the initial observation, affected address, changes applied and retest results in the same incident record.
| Area | Topic to clarify together | Expected record |
|---|---|---|
| Hosting and servers | Infrastructure, operating system and service management scope. | Service scope and technical owner. |
| Web application | Code, theme, plugin and dependency maintenance. | Update schedule and license inventory. |
| Accounts | Panel, domain, email and administrator permissions. | Access holders and offboarding procedure. |
| Data recovery | Backup frequency, retention, restoration and testing. | Backup plan and verification result. |
| Incident management | Notification, investigation, access restriction and recovery. | Authorized contacts and incident record. |
The sample routine below should be adapted to your organization’s risks and working practices. It is not a service commitment or a check frequency that applies to every site.
| Task | Example owner | Check timing | Result to keep |
|---|---|---|---|
| Panel and application access | Business account owner / agency representative. | When personnel or vendors change; at defined periodic reviews. | Current permission list and removed temporary access. |
| Application updates | Software maintenance owner. | On security advisories and during planned maintenance. | Pre-update backup, version and login/form/payment tests. |
| Backups and restoration | Designated backup owner. | Results of every backup job; recovery tests at planned intervals and on major changes. | Backup time, scope, restore result and measured duration. |
For WordPress projects, the official security guide explains approaches to access, updates, backups and logging. Record actual check results with the date and authorized person; do not mark unfinished work as successful.
If you see suspicious content, unexpected redirects or unauthorized access, share the affected address, time and observations in a support ticket. Do not include passwords, private keys or full card details in the message.
An access error alone is not evidence of an attack. Use the website not opening guide to distinguish DNS, certificate, HTTP and application errors.
Go to the support centreUse the reporting channel for abuse reports concerning services owned by others.
Containing an incident
Every incident has a different scope. The sequence below is a response framework to assess with your technical team.
Record affected addresses, the first observation time and existing logs. Avoid losing investigation data through unnecessary deletion or reinstallation.
Assess unauthorized accounts and exposed services. Isolate the affected application when necessary; manage recovery access from a secure environment.
Identify the compromised account, outdated plugin or exposed service. Deleting only visible malicious files may not provide a lasting fix.
Test the clean copy and updated configuration. Rotate keys and passwords; monitor application functions and subsequent logs.
If files and the database come from different times, order or content data may be inconsistent even when the site opens. Create mutually consistent restore points suited to your application.
A copy stored with access independent of the production account becomes important if that account is compromised. Do more than check that the copy exists; test restore duration and the checks needed afterward too.
Share your security and recovery needsHosting, malware investigation and application cleanup have different service scopes. If something looks suspicious, open a support ticket and describe your investigation needs. Cleanup, application repair and follow-up scope are determined separately.
SSL / TLS encrypts communications between visitors and the server. It does not alone fix application vulnerabilities, weak passwords or malicious plugins. Use it alongside access, update, backup and monitoring measures.
A WAF evaluates HTTP application requests against specific rules. DDoS measures can operate at different network or application layers against traffic attacks intended to disrupt service. Scope, capacity and application compatibility should be assessed separately.
Backup frequency depends on how much data you can afford to lose. A rarely changing informational site and a store receiving orders all day have different needs. Plan files, databases, retention and restore testing together.
In the client contract, separately assign responsibility for domains, hosting, software maintenance, licenses, backups and incident notifications. Limit access to client data to what is necessary, and plan how access will be handed over when the business relationship ends.
For specialized security assessments, target systems, written authorization, scope and suitable expertise must be defined separately. Standard hosting should not be treated as a penetration test or regulatory compliance certification.
FROM SELECTION TO SETUP
Share your website’s technology, current owners and priorities. Let’s assess the scope you need together.
