Topic hub

Website Security

Website security is the continuing management of identities, software, data and recovery. Small websites are commonly scanned automatically, so being obscure is not a defence and one security plugin is not a complete…

3 published guides0 subtopicsUpdated 21 July 2026

Start here

The main guide for this topic

Practical guide

Brute Force Attack Protection

Brute-force protection should address password guessing, password spraying and credential stuffing without locking legitimate users out indefinitely. The strongest defence is not a hidden login URL; i…

Open the complete guide →

Published guides

Articles in this section

Practical guide25 September 2026

Brute Force Attack Protection

Brute-force protection should address password guessing, password spraying and credential stuffing without locking legitimate user…

Read guide →

Step-by-step4 September 2026

How to Secure a Website

Securing a website is best treated as a sequence: establish ownership, reduce exposure, protect access, monitor changes and prepar…

Read guide →

Step-by-step21 July 2026

How to Prevent Contact-Form Spam

Contact-form spam ranges from harmless bulk messages to phishing, abuse of email delivery and automated attempts to exploit form h…

Read guide →

About this section

Information checked: 21 July 2026.

In brief: Protect critical accounts first, reduce unnecessary exposure and prepare to recover.

Build security in layers

Security layers for a business website
Layer	Controls	Owner question
Accounts	Unique identities, MFA, least privilege and offboarding	Who can change the site or billing?
Platform	Supported software, prompt updates and minimal components	What is exposed and maintained?
Application	Safe input handling, secure sessions and tested integrations	Can user input change or expose data?
Infrastructure	TLS, firewalling, logging and protected backups	Can an incident affect every copy?
Operations	Monitoring, incident plan and supplier contacts	How quickly can we contain and recover?

Prioritise high-impact controls

Protect domain, hosting, email and CMS administrator accounts with MFA.
Remove unused accounts, plugins, themes, API keys and services.
Apply security updates through a controlled process.
Keep restorable backups independent from the live system.
Monitor privileged access, unexpected changes and customer-facing functions.
Prepare an incident decision tree before a breach.

Know the limits of tools

A firewall can block known hostile traffic but cannot repair weak business processes or a stolen administrator session. Malware scanning can miss new or hidden code. Treat tools as evidence sources within an operating process.

Acceptance check

Security is credible when responsibilities, controls, monitoring, recovery and escalation are documented and tested rather than assumed.

Map security to business harm

A stolen editor account, compromised domain and vulnerable upload form create different risks. Rank controls by the effect on customers, data, reputation and recovery rather than by how many alerts a tool produces. Protecting the business mailbox may be more urgent than adding another scanner.

Records to keep

Threat and asset summary.
Privileged-account review.
Open security risks with owner and deadline.
Incident and recovery contacts.

Owner test: Choose the three most damaging website incidents and show which preventive, detective and recovery controls address each one.

Sources and date checked

This practical guidance was checked against the following primary sources. Date checked: 21 July 2026.