1. Check your website's underlying technology and apply security updates
Confirm which technologies and software versions your website uses, including the server-side language, CMS, ecommerce platform and hosting environment.
If your website uses PHP, ask your technical team to confirm whether it is affected by the recently disclosed vulnerabilities and whether the necessary security patches have been applied.
Don't assume your website is protected simply because the CMS itself is up to date. The underlying server software needs attention too.
2. Review who has access to your website
Audit all accounts with access to your CMS, website administration, hosting environment and other back-office systems.
Remove accounts belonging to former employees, agencies or contractors who no longer require access.
Apply the Principle of Least Privilege (PoLP), ensuring each user has only the permissions necessary to perform their role. Not everyone needs administrator access.
3. Enable multi-factor authentication (MFA)
Where supported, enable MFA for all users with administrative or privileged access.
This adds an important layer of protection if a password is stolen, reused or compromised through phishing.
4. Restrict access to administration areas
Consider limiting access to sensitive administration interfaces through approved IP addresses, a company VPN or other secure access controls, where practical.
You should also review whether default or easily discoverable administration URLs need additional protection. Some platforms, including WordPress, allow these to be customised, although changing a URL alone is not a meaningful substitute for strong authentication and access controls.
5. Review plugins, extensions and third-party integrations
Plugins and extensions add useful functionality, but they can also introduce vulnerabilities.
Remove anything that is no longer needed, check that remaining components are actively maintained and apply available security updates.
Review third-party integrations and API credentials too, particularly those that have access to sensitive information or important website functionality.
6. Check your backups and recovery arrangements
Ensure your website and its associated databases are backed up regularly, with secure copies stored separately from the live environment. More importantly, confirm that backups can actually be restored.
A documented recovery plan can significantly reduce downtime and disruption if something goes wrong.
7. Review your website's security protections
Ask your technical team whether appropriate security measures are in place, such as a web application firewall (WAF), bot protection, login rate limiting, secure HTTPS configuration and monitoring for suspicious activity. These controls can reduce exposure to common attacks and help identify potential issues earlier.
8. Consider an independent penetration test
An external security assessment can help identify weaknesses that may not be obvious through routine maintenance. This is particularly valuable for websites that process customer data, support online transactions or include bespoke functionality.
9. Reassess older website code against today's threats
A website developed several years ago may have been built to the security standards and best practices of the time. However, threats, technologies and development standards have moved on.
Ask your development agency to review the codebase, authentication processes, integrations and dependencies against current security recommendations. Pay particular attention to custom-built features and areas handling sensitive data.
10. Establish ongoing security ownership and monitoring
Make sure someone is explicitly responsible for website security, updates, vulnerability alerts and incident response.
Agree how frequently security reviews should take place, who will respond to urgent vulnerabilities and how quickly critical patches can be deployed. Security shouldn't depend on someone happening to spot a news article.
What should you prioritise today?
If you're unsure where your website stands, we'd suggest starting with three questions for your website provider:
- Does our website use PHP, and have the latest critical security updates been applied where required?
- Are our CMS, plugins, server software and other dependencies supported and fully patched?
- When was our website last reviewed for security vulnerabilities, and who is responsible for ongoing monitoring?
If your provider identifies an affected PHP installation, applying the relevant security update should be treated as an immediate priority, rather than waiting for a wider security review.
The key takeaway.
At Crafted, we know how much investment goes into building a brand's digital presence, attracting visitors and converting them into customers. Website security plays an important role in protecting that investment.
When pressure on budgets and time to market rise, it’s important to ensure your projects still follow robust development practices.
If you’re concerned about your web security or looking to move onto more secure infrastructure, our technical consultants can outline your options.
