Insights
A Practical Website Security and Maintenance Checklist
Review updates, backups, access, certificates, forms, monitoring and recovery planning as part of routine website maintenance.
Know what the website depends on
Keep an inventory of the CMS, extensions, hosting, domain, email delivery and integrations. Record who owns each account and how access is recovered. A forgotten provider account can become a practical recovery problem even when the website itself is working.
Review routine controls
- Apply appropriate software updates and check the site afterward.
- Use individual accounts with only the access required.
- Remove access that is no longer needed.
- Monitor domain and certificate renewals.
- Check forms, important links and connected services.
Check that backups can be restored
A backup file is useful only if it contains the required data and can be recovered. Agree where copies are stored, what is included and who can perform a restore. Test recovery in an isolated environment without overwriting the active website.
Prepare for a problem before it happens
Define who investigates a suspicious change, who contacts the host and who approves taking an affected function offline. Keep recovery contacts outside the system they may need to restore. Avoid placing credentials in public files or ordinary inquiry messages.
Keep expectations realistic
Maintenance reduces avoidable risk but cannot guarantee complete security or uninterrupted service. The care agreement should identify its scope, escalation route and exclusions, including work required when a third-party platform changes.