Website Security, Domains and Web Applications

The accounts behind your website

When customers type your business name into a browser, several things happen in the background. A domain registrar holds your domain name. DNS settings point that name to your website and to your email service. A hosting provider runs the website. A content management system (CMS), such as a site builder or blogging platform, lets someone update pages. Each of these has a login. If someone takes over the registrar or DNS account, they may be able to redirect your website and even your email. If the domain expires, it can stop working or be lost. These accounts are rarely used, so they are easy to forget, which is exactly why they need care.

Protect the domain and DNS

• Turn on MFA for the registrar, DNS and hosting accounts.
• Keep the number of admins small and make sure each one is a current, named person.
• Use a business email address that the company controls for these accounts, not a former employee’s or web designer’s personal address.
• Turn on registrar lock (sometimes called transfer lock) if your registrar offers it, so the domain cannot easily be moved to another provider.
• Know who owns renewal. Record the renewal date and consider auto-renewal with a valid payment method.

Keep the website itself healthy

Many small business sites run on a CMS with add-ons called plugins or extensions. Each one is software that can have weaknesses. Outdated plugins and forgotten admin accounts are a frequent way into small websites. The fix is routine maintenance: apply updates to the CMS, themes and plugins; remove plugins you do not use; remove admin accounts for people who have left, including old agencies; and give staff the lowest level of access they need. If your website has a contact form, online orders or customer logins, it holds customer data, so maintenance matters even more.

A simple website maintenance routine

1. 1Name one person who owns the website, even if an agency does the technical work.
2. 2Apply CMS, theme and plugin updates regularly, or confirm in writing that your agency does this.
3. 3Review admin users every few months and remove anyone who no longer needs access.
4. 4Keep backups of the website and its database stored separately from the website itself, and test a restore at least once.
5. 5Protect any API keys or payment gateway keys. Do not paste them into emails, chats or shared documents.
6. 6Record your registrar, renewal date, DNS owner, hosting provider, CMS admin and backup method on one page, with no passwords on it.

HTTPS is good, but it is not the whole story

The padlock or 'https' in the address bar means the connection between the visitor and the website is encrypted. That is important, and every business site should use it. But it does not mean the website itself is free from weaknesses, that the plugins are updated or that the business behind it is genuine. Fake websites can have HTTPS too. Treat HTTPS as one basic layer, not proof of security. Also note that testing a website for weaknesses should only be done by people who are authorised to do so, with an agreed scope. Never test sites you do not own or have permission for.