Website Cybersecurity: Protect Accounts, Updates, and Recovery

A small business can lose control of its website through a compromised email or domain account even when the website code itself is sound. Begin with the accounts that can reset access, change DNS, or publish to production.

Secure the accounts with the widest reach

List the registrar, DNS provider, hosting account, CMS administrators, and business email. Assign a named owner and recovery contact. Use unique credentials, a password manager, and multifactor authentication, preferably phishing-resistant methods where supported. Remove former staff and unused integrations. CISA’s security guidance.

Reduce avoidable exposure

Maintain an inventory of software and integrations, apply supported updates, and test important changes before release. Restrict administrator privileges, keep secrets out of public repositories, and review where contact forms send data. HTTPS protects a connection but cannot fix excessive permissions or a stolen administrator session.

Practice recovering one critical service

Restore a recent backup in a separate environment, confirm that images and records are usable, and record how long it takes. Write down who can revoke compromised access and who contacts the host or registrar. If an incident occurs, preserve relevant logs and involve the responsible technical team before making broad changes that could destroy evidence.

Related guides and services

Design and technology
Create a website · Blockchain · E-commerce marketing

More from Dopweb
Online reputation management · Dopweb homepage · Deciding whether to use AMP · Search engine optimization · Book a call

Search and marketing
Social media marketing · Business blogging · SEO