The configuration of baseline technical measures that protect the website from threats, ensure data can be recovered if something goes wrong, and establish the performance optimisation settings that ensure the site loads quickly and reliably for all visitors.
SSL certificate (HTTPS), a web application firewall (WAF), regular software and plugin updates, strong administrator password policies and two-factor authentication, IP-based admin access restrictions, malware scanning and a defined process for responding to security incidents.
A WAF filters incoming web traffic, blocking requests that match patterns associated with known attacks — SQL injection, cross-site scripting (XSS), brute force login attempts and other common attack vectors. Cloudflare and Sucuri are widely used WAF services.
Daily automated backups are standard for active business websites. E-commerce sites processing daily orders should have more frequent backups (hourly or near-real-time). Backups should be stored off the primary server so that a server failure doesn’t also destroy the backup.
The database (containing all content, user data and configuration), the file system (including the CMS core files, theme and plugin files and uploaded media) and any environment configuration files needed to restore the site to a functioning state.
By periodically performing a test restore to a staging environment — verifying that the backup is complete, restorable and functional. A backup that has never been tested should not be considered reliable.
Server-side caching (for CMS platforms like WordPress, using a caching plugin), image optimisation (compressed, correctly formatted and lazy-loaded images), a CDN (for globally distributed static asset delivery), minification of CSS and JavaScript files and correct Cache-Control headers.
Giving users and systems only the minimum level of access required for their role. An editor doesn’t need administrator access. A third-party plugin doesn’t need database write permissions beyond its defined function. Applying least privilege reduces the potential damage of a compromised account or component.
A professional assessment of a website’s security posture — testing for vulnerabilities in the code, configuration, authentication and third-party integrations. A security audit is appropriate at launch for sensitive applications (e-commerce, member portals) and annually for any site holding personal data.
Immediately take the site offline or into maintenance mode, contact the hosting provider, restore from the most recent clean backup, investigate the attack vector to prevent reinfection, change all access credentials and report any personal data breach as required by GDPR.
