How to Secure a CMS Website Against Cyberattacks: A Checklist for Companies and Organisations
A practical checklist to reduce the risk of your website being hacked: from regular updates and access rights to backups and monitoring.
Most websites are not hacked by sophisticated attacks. They are hacked because of basics that were missed: software that was not updated, weak passwords, or no backups. Here is the checklist we apply to client websites, from companies to NGOs and media outlets that are frequent targets.
1. Always update core and modules
Follow your CMS security releases. In Drupal, security advisories are published on a regular schedule by the official security team. Test updates on staging, then apply them to the live site as quickly as possible. Avoid CMS versions that are no longer supported, such as Drupal 7.
2. Limit access rights
- Give each user only the permissions they need (an editor does not need administrator access).
- Remove accounts of former staff and inactive accounts.
- Do not share a single account between several people.
3. Strong passwords and two-factor authentication
Require long, unique passwords, use a password manager, and enable two-factor authentication (2FA) for administrator accounts.
4. Reduce modules and plugins
Every extra module is code that has to be maintained. Remove modules you do not use and choose ones that are actively developed and covered by the official security policy.
5. Automatic backups that can really be restored
Back up the database and files on a schedule, keep copies in a separate location, and test the restore process regularly. A backup that has never been tested cannot be relied on.
6. HTTPS and security headers
Make sure every page uses HTTPS with a valid certificate, and add security headers such as HSTS, X-Frame-Options and Content-Security-Policy as needed.
7. Protect forms and logins
Protect forms from spam and bots (for example with a honeypot or a privacy-friendly CAPTCHA) and limit repeated login attempts.
8. A well-managed server
Supported PHP and database versions, a web application firewall, and separation between accounts on the same server make a big difference to security. Choose managed hosting, not just cheap hosting.
9. Monitor and log
Monitor uptime, file changes and error logs. An attack that is detected early is far easier to deal with.
Need a website security audit?
We offer an initial check of your website's security and speed. Contact us via WhatsApp +62 813-5767-5500 or email [email protected]. Also learn about our website maintenance and hosting & managed server services.
Need a website that works for your business?
Tell us what you need. We will send a clear cost estimate and schedule, with no obligation.