Website security needs a named owner

A website can remain online while nobody is clearly responsible for its security. The designer assumes the host handles updates. The owner assumes backups are included. A former contractor still has access because nobody remembers which account they used.

Those are practical questions a business owner can resolve without becoming a cybersecurity specialist. Start by asking who does each job, what evidence shows it happened, and who responds when something goes wrong.

Follow the accounts behind the website

List the domain registration, hosting or website platform, administrator accounts, business email, and any booking or form service. Record who is authorized to manage each one. An account registered to a former employee’s personal email deserves attention before you need to recover it.

Use separate authorized logins where supported, unique passwords, and multifactor authentication, which adds another check beyond a password. Ask about phishing-resistant options where available. CISA recommends MFA and a move toward phishing-resistant methods; a provider should be able to explain the options for your actual services. CISA MFA guidance

Keep passwords and recovery codes in an appropriate secure system, never in a shared planning worksheet. Give vendors only the access their work requires and remove it when that work ends. FTC vendor-security guidance (PDF)

Ask what maintenance actually covers

For a managed platform, ask which updates the platform performs and which remain your responsibility. For a site with themes or plugins, identify who checks those components, applies security fixes, and verifies that important functions still work afterward.

“Maintenance included” needs a written scope. Ask how urgent security updates are handled, who responds to a failed update, and what happens when a component is no longer supported. The FTC recommends regular software updates and explicit questions about a web host’s security responsibilities. FTC cybersecurity guidance

Request a restore test

“We have backups” leaves several questions unanswered. What is copied? How often? How much recent work could be lost? Can the copy be recovered if the normal administrator account becomes unavailable?

Ask your provider to demonstrate restoration in a safe test environment, not by overwriting the live site. Record the date, what was restored, and anything the test excluded. A copy of page text may not include bookings, uploaded files, or settings. CISA recommends protected backups and regular recovery testing. CISA StopRansomware guide

Collect less through forms

Consider a hypothetical landscaping business whose quote form asks for a customer’s date of birth. If that information has no genuine purpose at this stage, why request it?

Review every field, including optional uploads. Find out where submissions are stored, whether copies remain in email, who can read them, and when they are deleted. The FTC advises collecting and retaining only information the business needs. Do not invite passwords, payment-card details, or unnecessary sensitive records into a general contact form. FTC personal-information guide

Give suspicious messages a clear route

A message claiming your domain will expire can create pressure to act quickly. Instead of using its sign-in link, verify through a known provider contact or a trusted route to the account. Make it easy for staff to report a suspicious message, including when someone has already clicked. NIST phishing guidance

Before your next provider conversation, check:

• Who owns the account-access and recovery process?
• Who installs and checks updates?
• When was restoration last demonstrated?
• Which form fields can we remove?
• Who takes the first call about a suspected incident?

These steps reduce avoidable gaps; they do not certify a website as secure. If you suspect a breach, involve qualified help promptly and preserve evidence. Notification obligations depend on the facts and applicable law. FTC breach-response guide

Further reading

• CISA MFA guidance — account protection.
• FTC Cybersecurity for Small Business — hosting, maintenance, and vendor questions.
• CISA StopRansomware guide — protected backups and recovery preparation.
• FTC personal-information guide — collecting less and protecting what remains.
• FTC breach-response guide — responding to a suspected exposure.

Try the companion worksheet

Use the Website security responsibility worksheet with your provider. Bring back named owners and evidence, not a reassuring score.