Website security: access, updates and recovery
Practical security checks for business websites, from account permissions to backup restoration, with OWASP and CNIL sources.
Website security starts with understanding what the site stores and who can change it. A brochure site, a shop and a social platform expose different functions. Begin with the actual services and data before choosing additional tools.
Inventory the accounts and data
List the domain registrar, host, repository, CMS, email delivery service and administrators. Record ownership, authorised users and recovery procedures. Remove access that a former contributor no longer needs.
Identify contact messages, uploads, customer records and other stored information. Establish who can view them and how recovery would work if the usual maintainer were unavailable. The owner should retain access to the services that keep the business online.
Protect authentication and recovery
Use individual accounts, unique passwords managed securely, and multifactor authentication where available. Protect the email account used for password resets as well. Give users the permissions needed for their job rather than making everyone an administrator.
OWASP's authentication guidance covers useful controls for repeated login attempts and account recovery. Test the recovery route as carefully as the ordinary sign-in journey.
Maintain every part of the stack
For WordPress, follow updates to the CMS, themes and extensions. For custom software, follow the framework, dependencies and runtime. A custom build is not automatically safer: security depends on implementation and exposed functionality.
Prepare a backup and a test before a significant update. Afterwards, verify sign-in, publishing and contact functions. Remove unused components when they no longer serve the project.
Verify permissions on the server
Hiding a button does not prevent an unauthorised request. The server must check both the user and the action. In a test environment, use accounts with different roles and confirm that each can only access its own permitted information, including through direct URLs.
The AtypikLove case study describes privacy controls and text and image moderation in a social platform. It illustrates why public profiles, private information and allowed actions need separate treatment. Moderation does not replace access control, and a case study is not a security audit report.
Protect forms while keeping them usable
Use HTTPS and monitor certificate renewal. Validate input on the server, restrict uploaded files and keep secrets out of browser-delivered code. A visual validation message or a spam trap is not complete protection. Test anti-spam measures with a keyboard and assistive technology; the form guide provides a usable test sequence.
Prepare for recovery
Restore files, the database, media and configuration into a separate environment. Choose backup frequency based on the new data the business receives. Record the responsible person and a support contact.
After an incident, preserve useful logs, contain the problem and identify its cause before bringing a backup online. If personal data is involved, assess the applicable notification duties. In France, the CNIL procedure explains risk-based notification and the 72-hour deadline where notification is required.
A useful maintenance arrangement makes ownership, update checks, permissions and restoration verifiable. No individual tool guarantees that a site can never be compromised.