Blog

Get Ahead with Regular Security Audits #

Let's start with the basics: regular security audits.

Think of it like going to the dentist—you don’t want to wait until you have a problem before you check things out. Your website's security is the same.

Scheduling security audits helps you catch security vulnerabilities, like cross-site scripting (XSS), before they become serious issues.

How to get started: #

• Use tools like Invicti (formerly Netsparker) or Sucuri for automated scanning. These security plugins can scan for malware, outdated software, and known vulnerabilities.
• Set a reminder to perform these audits quarterly or monthly, depending on the complexity of your site.
• If you don’t have an in-house team, consider hiring a cybersecurity expert or agency for a more thorough review.
• Make sure you’re auditing your SSL certificates to maintain Hypertext Transfer Protocol Secure (HTTPS) connections, your login pages, and any third-party plugins (these are often weak links).

Two-Factor Authentication (2FA): Your Site’s First Defense #

By now, we’ve all heard about two-factor authentication, but are you actually using it?

Passwords aren’t enough these days—especially if your site has multiple users with admin privileges.

2FA ensures that even if someone gets their hands on a password, they still can’t access your site without an extra layer of authentication.

How to get started: #

• Use a tool like Google Authenticator or Authy to implement 2FA on your site.
• Work with your IT or web development team or website owner to enable 2FA for anyone with admin access to your website.
• Start by rolling it out for high-level accounts first (like admin users), then gradually expand it to other team members.

Keep SSL Certificates Current (Seriously, Don’t Let Them Expire) #

SSL (secure sockets layer) certificates are a no-brainer for any website handling customer data, and they're crucial for building trust with visitors (and Google).

If your SSL certificate expires, your users will be greeted with a “Not Secure” warning—which is basically the kiss of death for online credibility.

How to get started: #

• Make sure you're using a secure hosting service. If you're not using a reliable hosting provider, that's not a great start.
• Check if your current hosting provider offers automatic SSL renewals. Many hosts, like Arcustech (our preferred provider), offer this as part of their packages with SSL certificates starting at just $29 P/M. If you're running your site through Cloudflare, you can also get an SSL certificate at no additional charge, along with numerous other benefits (discussed below).
• Use tools like SSL Labs to check if your certificates are up to date.
• Set a calendar reminder to renew your certs a month before the expiration date.
• If you manage multiple domains, consider using a wildcard SSL certificate to cover all subdomains. This will streamline the process and reduce the number of certificates you need to manage.

Block Control Panel Access to Specific IP Addresses #

Restricting access to your control panel (CP) is a simple but effective way to boost security. Limiting access to only known IP addresses can prevent unauthorized logins.

How to get started: #

• Use Cloudflare Teams or firewall settings from your hosting provider to block CP access from unknown IPs.
• Consider using a VPN for your team to securely access the CP.

Backups: The Insurance Policy You Hope You Never Need #

No one thinks they’ll get hacked until they do.

The best way to minimize damage in case of a breach is to have backups in place. Regular, automated backups guarantee that if something goes wrong, you can restore your site quickly without losing critical data.

How to get started: #

• Set up daily or weekly backups using your CMS. For Craft CMS sites, you can use the Remote Backup plugin or choose a hosting provider that offers backups, like Arcustech. 
• Store your backups in the cloud using services like Amazon S3 or Google Cloud.
• Test your backup system at least once a quarter to make sure the restore process works as expected.
• Always have at least one offsite backup (in the cloud), so if your server goes down, you can still recover everything. It’s the “just in case” measure that can save your site (and your sanity) when things go wrong.
• If you’re not a tech whizz or using a platform like Craft CMS, you’ll probably need to ask your developer to install and set up the remote backup plugin for you. 

Enable Secure File Transfers #

Outdated methods of transferring files can expose your site to vulnerabilities. By upgrading to more secure, encrypted methods, your site’s data remains safe during updates and changes.

How to get started: #

• Talk to your developer about switching to secure, encrypted file transfer methods that reduce the risk of interception.
• Remove old, less secure methods from your hosting settings to ensure data protection during every update.

Install a Web Application Firewall (WAF) to Keep Threats at Bay #

A web application firewall (WAF) is an anti-malware software that filters out malicious traffic before it reaches your website. Look at it like a bouncer at a nightclub—only letting in the people who are supposed to be there. 

How to get started: #

• Use cloud-based WAFs like Cloudflare or Sucuri. You can set up these services without any complex server configurations.
• Check with your hosting provider—many offer built-in WAF options as part of their security packages.
• Once installed, monitor your traffic logs to see what types of threats are being blocked.
• Work with your web team to configure the WAF settings for your specific site needs. You’ll also want to update your WAF regularly to defend against new types of attacks.

Use a Content Delivery Network (CDN) for Speed & Security #

CDNs aren’t just for speeding up your website. They can also improve security by distributing traffic across multiple servers and minimizing the risk of DDoS attacks.

With a CDN in place, you get the best of both worlds: faster load times for your users and better protection against cyber threats.

How to get started: #

• Sign up for a CDN service like Cloudflare or Akamai. These services include DDoS protection as part of their security package.
• Your web developer can integrate the CDN with your website by pointing your DNS records to the CDN service.
• Once integrated, your CDN will cache your site’s content across multiple global servers, improving speed and distributing traffic.
• Make sure your CDN is configured to block malicious traffic, not just speed up your site. 

Like what you’re reading? You might also enjoy our “Guide to Finding a Reliable Agency or Service Provider”, too!

Automate Updates for Peace of Mind #

One of the most common reasons websites get hacked is because of outdated software or plugins.

Don’t let this happen to you.

Set up a regular update schedule with your team—whether it’s for your content management system, plugins, or third-party integrations. This ensures you’re always running the latest, most secure versions, without having to micromanage every little detail.

How to get started: #

• For platforms like Craft and ExpressionEngine, we recommend scheduling quarterly updates with your web team.
• Platforms like Shopify and Squarespace handle these updates for you.
• If you’re worried about updates breaking your site, use staging environments where you can test updates before going live.

Train Your Team: Security Is Everyone’s Job #

Even with all the best tools and firewalls, human error is still the number one cause of security breaches.

Educating your team about basic security practices—like how to spot phishing emails, not sharing logins, or using secure passwords—goes a long way in preventing attacks. Run regular training sessions and consider phishing simulations to keep everyone sharp.

Image Source: Statista

Have a Crisis Plan (Before You Need It) #

No matter how secure your site is or how amazing your hosting providers are, breaches happen.

The key to minimizing the damage is having an incident response plan in place.

This plan should outline exactly what to do in the event of a security breach—who to contact, what steps to take, and how to communicate with your customers and stakeholders.

Don’t Wait for a Security Breach to Take Action #

Website security often gets pushed to the back burner, but waiting until something goes wrong can cost you. 

The good news? A few quick updates and ongoing maintenance can make all the difference. The sooner you start, the less likely you’ll find yourself scrambling to fix a security breach later. Prevention is always easier—and cheaper—than damage control.

Managing your marketing efforts is already a full-time job. Adding website security to your list? That’s overwhelming. But it doesn’t have to be. Why not let our website security pros take it from here?

Reach out today and let’s make your site's security is rock-solid.