Maintain supported software
Keep the platform and extensions supported and use trusted sources for updates. Review unused components and test changes appropriately. A security plugin does not replace basic maintenance.
Control account access
Use individual permissions, strong unique credentials and available multifactor authentication. Remove access that is no longer needed. Avoid sharing the main owner login with every supplier.
Keep recoverable backups
Back up the needed files and data, protect copies from the same failure and test restoration. A hosting backup label does not establish scope, retention or a working recovery process.
Plan for incidents
Know who can restrict access, restore service and investigate exposed information. HTTPS protects data in transit but does not guarantee the site or business is trustworthy. Appropriate privacy and incident obligations depend on the actual operation.
Questions about this guide
What should I ask a website maintainer about account access?
Ask who has administrator access, how sign-ins are protected and how departed users are removed. Use named accounts with the permissions each person needs.
How do I know backups are useful after a website incident?
Ask for a documented restoration test and where protected copies are kept. A backup job reporting success does not establish that the full site can be restored.