There’s a point near the end of some website projects where security suddenly enters the conversation.
The design is approved. The pages are built. The forms work. Everybody likes the photos. Someone is preparing to launch the site and eventually asks, “Oh, what about security?”
That’s a little late.
Security isn’t something we should bolt onto a WordPress website at the end of the project, install a plugin for, check a box, and pronounce the site secure forever. If you’ve been following our Secure September series, you already know how we feel about the “forever” part.
We think about security while the website is being planned and built, and then we keep thinking about it after the site launches.
That doesn’t mean every business website needs the cybersecurity equivalent of Fort Knox. It means making sensible decisions about the software, hosting, access, forms, backups, maintenance, and other pieces that can either reduce risk or quietly create it.
There’s an important distinction there.
No professional web company can promise that a website will never be attacked or compromised. Anyone making that promise has considerably more confidence than I do in either technology or human beings.
What we can do is build and manage a site in a way that eliminates a lot of unnecessary risk.
One of the advantages of having a process is that you get to ask questions before you start building.
What does the website actually need to do? Will customers be submitting information through forms? Does it need e-commerce, scheduling, memberships, downloads, or other functionality? Who inside the company will need access? Who is going to maintain the site after launch?
Those questions affect security.
Every feature we add to a website creates another piece of software, another integration, another login, or another flow of information that may need to be managed. That doesn’t mean we avoid functionality. It means we don’t add things simply because somebody found a plugin that does something interesting.
I’ve seen WordPress sites with an astonishing number of plugins installed, some of which nobody could remember using. Apparently they were being preserved for historical purposes.
We prefer to understand what the site needs first and build around that.
The fewer unnecessary moving parts we introduce, the fewer unnecessary moving parts somebody has to maintain later.
Plugins are one of the reasons WordPress is so useful. They’re also one of the reasons WordPress sites need ongoing attention.
A good plugin can save an enormous amount of development time and provide functionality that would make absolutely no sense to build from scratch. We use plugins. We like plugins.
We’re just not collecting them.
Before adding something to a site, we want to know whether it’s reputable, actively maintained, compatible with the rest of the website, and actually necessary. We also think about what happens later. Is the developer still going to be supporting it? Does it receive updates? Are we introducing functionality that can be handled more cleanly another way?
This becomes even more important when we inherit an existing site.
One of the first things worth understanding is what’s already installed, what’s being used, what isn’t, and whether anything has been abandoned. It’s not unusual to open the backend of an older WordPress site and discover plugins that haven’t been needed in years.
Software doesn’t become safer because everyone forgot it was there.
Another fairly basic part of website security is deciding who should be able to do what.
Not everyone who needs access to a WordPress site needs full administrator privileges.
That sounds obvious, but administrator accounts have a way of multiplying over the years. An employee gets access. Then an outside marketing person needs access. A freelancer is brought in for something. Somebody creates another account because nobody can remember the password to the first one.
Eventually the user list becomes something of an archaeological record of everyone who has ever interacted with the company.
That’s not ideal.
We’d rather keep access appropriate to the work someone actually needs to perform and remove access when it’s no longer needed. Strong credentials matter too, as does avoiding the charming tradition of sharing one administrator password among six people by email.
Security is often less dramatic than people expect.
Sometimes it’s simply knowing who has the keys.
Hosting tends to be treated as an afterthought because the visitor never sees it.
They see the design, photographs, copy, and forms. Nobody arrives at a website and says, “What a lovely server environment.”
Still, where and how a website is hosted matters.
Hosting affects uptime, performance, backups, SSL, server configuration, security, and what happens when something goes wrong. It’s one reason we offer hosting rather than simply building a site and sending the client off to find the least expensive server they can locate.
Cheap hosting can work perfectly well.
Until it doesn’t.
And the middle of a security problem is a bad time to discover that the $4.99 hosting plan came with roughly $4.99 worth of help.
For websites we host and manage, hosting becomes part of the larger relationship. We know the site, we know the environment, and we’re not meeting either one for the first time while something is broken.
That has value well beyond server space.
Most business websites need forms.
A prospective customer fills one out, the business receives the information, and everyone is happy.
From a security standpoint, though, a form deserves a little more thought because it accepts data from outside the website. Spam bots know this too. They have apparently made it their life’s work to remind us.
When we build forms, we think about what information actually needs to be collected, how submissions are handled, what kinds of files can be uploaded when uploads are necessary, and what protections should be in place.
There’s a larger business question here as well.
Just because you can collect a piece of information doesn’t mean the website needs it.
If a business only needs a name, phone number, email address, and a short message to start a conversation, asking for considerably more personal information may create risk without providing much benefit.
Good security occasionally means deciding not to collect something in the first place.
We talked about backups in the first two Secure September posts because they’re one of the least interesting parts of a website right up until they become the most interesting part of the website.
We plan for them from the beginning.
A backup gives us somewhere to go when something fails, whether the cause is malware, an update conflict, a server issue, human error, or one of the thousands of other ways computers occasionally remind us who is really in charge.
The important thing is having dependable backups and knowing there’s a recovery path.
That changes how maintenance works too.
If we’re updating WordPress or changing something substantial on a site, knowing we have a recent backup allows us to work much more intelligently. We’re not simply hoping everything goes perfectly.
Hope has many excellent uses.
I don’t particularly like it as a disaster recovery strategy.
Visitors have become accustomed to seeing https and the browser indicators that tell them a connection is secure.
They’ve also become accustomed to leaving when their browser throws up a warning.
Understandably.
SSL is part of the basic infrastructure we consider when setting up and managing a business website. So are the other security protections around WordPress and the hosting environment.
Again, none of these things makes the site invincible. The goal is layered protection.
If one safeguard doesn’t stop something, another may. If a vulnerability is discovered, an update can close it. If malicious activity occurs, monitoring can help identify it. If something does get damaged, backups provide a way to recover.
Security works much better as a system than as a checkbox.
There’s nothing inherently wrong with building your own website.
For a new business with a very limited budget, a DIY site may be exactly the right decision. I’m certainly not going to argue that a company should spend money it doesn’t have just so a professional can choose its WordPress theme.
The problems tend to show up later.
The person who built the site gets busy running the business, because that’s generally what happens to business owners. Updates get postponed. Plugins accumulate. Backups are assumed to be happening somewhere. Hosting was selected three years ago based primarily on price. Nobody remembers which email address controls one of the important accounts.
The website continues to work, so nothing feels urgent.
Until something does.
The issue isn’t that the site was DIY. The issue is that nobody has owned the technical responsibility since the weekend it was built.
Professional website management provides continuity.
Somebody knows what’s there.
Somebody is paying attention.
That’s much more valuable than it sounds.
We’ve also inherited plenty of professionally built websites that were effectively abandoned after launch.
A company paid good money for a nice site. The developer handed it over, everyone shook hands, and that was the end of the relationship.
Three years later, the site is still running whatever happened to be installed at the time.
A professional build doesn’t make that scenario much better.
A well-built site can still become vulnerable when software is neglected, plugins are abandoned, backups fail unnoticed, or nobody is monitoring what’s going on.
That’s why we don’t view design, hosting, maintenance, and security as completely separate conversations.
They’re different services, but they affect one another.
The decisions we make while building the website influence how easy it is to maintain later. The hosting environment affects security and recovery. Maintenance keeps the software current. Monitoring gives us a chance to catch problems. Backups give us options when something goes wrong.
It all fits together.
One of the things I like about an ongoing client relationship is that we’re not starting from zero every time there’s a problem or a new idea.
We already know the site.
We know how it was built, which plugins are important, how the hosting is configured, what the business is trying to accomplish, and what changes have been made over time.
That’s useful for security, but it’s useful for everything else too.
When the business wants to add a service, launch a campaign, improve SEO, build a new landing page, or change something substantial, we’re working with a system we already understand.
That’s why Strottner Designs isn’t interested in simply being the company that builds the website.
We can design it. We can host it. We can maintain it. We can help protect it. And when a business already has a WordPress website, we can look at what’s there and help determine what needs attention.
Our current services specifically include website design, hosting, website security, and ongoing website maintenance and support, so the relationship doesn’t have to end when the site goes live.
Not every security conversation needs to begin with a new website.
Maybe you already have one and you’re perfectly happy with the design.
Great.
The more useful question may be what’s happening underneath it.
Who is maintaining WordPress? Are the plugins current? Is anything installed that shouldn’t be there? Are backups running? Is SSL configured properly? Who has administrator access? What happens if the site goes down? Does anyone know whether the hosting environment is still appropriate for the business?
Those are things we can evaluate without automatically turning the conversation into “you need a new website.”
Sometimes a site needs to be replaced.
Sometimes it needs maintenance.
Sometimes it needs better hosting.
Sometimes it simply needs somebody competent to go through it and tell the owner what they actually have.
I’m a big fan of diagnosing the problem before prescribing the treatment.
It saves everybody a lot of time.
The point of Secure September hasn’t been to frighten business owners into staring suspiciously at their WordPress dashboard.
It’s to make the risks understandable.
Week 1 was about what can go wrong. Week 2 was about why the work continues after launch. This week is really about how those ideas affect the way we build and manage websites at Strottner Designs.
We think about security while we’re building.
We think about what happens after launch.
And we want the client to know who is responsible when something needs attention.
That last part matters more than any individual plugin or security feature.
If you’re planning a new WordPress website, we can build it with the long-term health of the site in mind, not just launch day. If you already have a site, we can host it, maintain it, help secure it, or take a look at what you currently have and tell you where the problems may be.
You don’t have to wait for a hacked site, a browser warning, or a frantic Monday morning phone call to start thinking about any of this.
We actually prefer meeting under less exciting circumstances.
Talk to Strottner Designs about your WordPress website.
Maybe you’re planning a new site and want security considered from the beginning. Maybe the site is already built but needs better hosting or ongoing maintenance. Or maybe you simply don’t know what condition it’s in because nobody has looked under the hood in a while.
That’s fine. We don’t need to start with the assumption that you need a new website.
Strottner Designs can design, host, maintain, secure, or evaluate your WordPress website and help determine what actually needs attention.
If you’re not sure where to start, start with a conversation.
Privacy Policy | Sitemap | Terms of Use
