Key takeaways
- Keep software supported and apply security fixes after testing.
- Use MFA, limited access and backups you have actually restored.
- Email authentication reduces spoofing risk; it cannot prevent every impersonation.
Start with the basics
List your CMS, plugins, application dependencies, runtime and server software. Remove unused components, update supported versions and test changes on a staging copy. Keep a backup and rollback plan.
Protect the paths in
Use individual accounts, MFA and minimal permissions. Restrict administration through SSH keys or a VPN. Store API keys on the server, rotate exposed secrets, limit expensive requests and monitor overall provider spend.
Prepare to recover
Keep versioned backups away from the production server and test a restore. Monitor availability and certificate expiry from outside. Agree who responds to alerts and how to escalate an incident.
Turn a checklist into action
An audit should give you a prioritised list with evidence and a recovery plan. We can assess your site, application and network, fix agreed issues and set up ongoing care.
Sources and further reading
The service behind this article
Security & hardening
Site, server and network protection, plus application security.