Protect accounts and reduce unnecessary access
Use unique passwords and multi-factor authentication where supported, especially for domains, hosting, CMS administration and email. Remove accounts belonging to former staff or providers and avoid sharing one administrator login among several people.
Give users only the permissions they need. An editor usually does not require access to hosting configuration or every plugin setting.
Keep software and integrations supported
CMS platforms, plugins and libraries should be maintained. Unsupported software can create risk even when the public pages appear to work normally. Test significant updates and keep recoverable backups.
API keys and credentials should not be published in browser code when they are meant to remain secret. Third-party integrations also need review when providers change authentication or retire older versions.
Prepare for recovery, not only prevention
No security plan can promise that an incident will never occur. Know where backups are stored, how recent they are and who can restore the site. Logging can help investigate unexpected changes.
Collect only information the business actually needs and consider the sensitivity of data before adding forms or account features.
Email accounts connected to the website deserve equal attention because password resets, domain notices and hosting alerts often arrive there. Compromised email can undermine otherwise strong website security. Protect administrative mailboxes, review forwarding rules and keep recovery information current. When a provider needs temporary access, use individual accounts where the platform supports them rather than sending the owner's password by ordinary email.