Website Security: 10 Things Every Business Owner Should Be Doing
Website security is not only a concern for large corporations.
Small businesses, schools, organizations, e-commerce stores and professional websites can all become targets of automated attacks.
And security isn’t something you configure once and forget.
WordPress describes security as an ongoing process involving risk reduction, monitoring, maintenance and recovery planning.
Here are ten important areas every business website should consider.
1. Keep WordPress updated
WordPress core should be kept current, along with properly maintained themes and plugins.
Updates can contain important security and compatibility fixes.
2. Keep plugins and themes under control
Don’t keep unnecessary or abandoned plugins installed simply because they aren’t currently active.
Every piece of software on a website increases the amount of technology that needs to be maintained.
3. Use strong administrator passwords
Administrator accounts have significant control over a website.
Use strong, unique passwords and avoid predictable information such as names, company names or simple number combinations.
4. Use two-factor authentication
Where supported, two-factor authentication adds another layer of protection to administrator accounts.
WordPress’s current security guidance recommends 2FA for administrator accounts.
5. Limit administrator access
Not everyone who needs to edit website content needs full administrator privileges.
Use appropriate user roles and only provide the access someone actually needs.
6. Protect your login area
Automated bots can repeatedly attempt to access WordPress login pages.
Rate limiting, firewall/WAF protection and other appropriate controls can help reduce abusive login traffic.
7. Use HTTPS
Your website should use HTTPS with a properly configured SSL/TLS certificate.
HTTPS helps protect communication between visitors and the website and is particularly important for login pages and websites handling sensitive information.
8. Maintain reliable backups
Security isn’t only about preventing attacks.
You also need a recovery plan.
If something goes wrong, a reliable and usable backup can make the difference between recovering a website and rebuilding it from scratch.
9. Monitor the hosting environment
Website security extends beyond WordPress.
The hosting environment, server software, file permissions, databases, email systems and network configuration can all form part of the security picture.
This is why website security and server administration often need to work together.
10. Have a recovery plan
No security system can promise zero risk.
A responsible approach is to reduce the likelihood of problems while also preparing for recovery if something happens.
That means knowing:
- What is backed up?
- Where is it backed up?
- When was it last tested?
- Who has administrator access?
- How would the website be restored?
- Who would investigate the incident?
Security is a process, not a button
Installing a security plugin does not automatically make a website secure.
Good website security involves maintenance, access control, software updates, monitoring, backups, server protection and recovery planning.
At Feebmax Global Services, we look at website security as part of the wider digital infrastructure supporting your business.
Is your website properly protected?
Feebmax provides Website Security, CMS Administration, Server & Hosting Support, Network & DNS Management and Technical Troubleshooting.
Your website is part of your business.
Treat its security like part of your business infrastructure.