CMS website security: an owner's checklist for one evening

A hacked site rarely looks like in the movies. More often it keeps working while foreign links quietly appear, redirects to other pages start, or your server begins sending spam. The owner learns from customers or from a search engine's email, or something even worse. Preventing it is cheaper than dealing with the consequences.

Where the threat comes from

OWASP, the organisation that maintains the register of main web application risks, lists vulnerable and outdated components as a separate item. The risk exists if you do not know which versions you use, if the software is out of date or unsupported, and if there is no plan for regularly applying updates.

For a CMS site that means the system, modules, plugins, the theme and script libraries. Any element can contain a hole that is already known.

CISA, the US cybersecurity agency, maintains a catalogue of vulnerabilities that attackers are already exploiting and recommends using it to decide what to fix first. The practical point: if a security fix has been released for your component, do not postpone it.

An evening checklist

0. If you have a contractor or in-house specialist

If you have a contractor or an in-house specialist (a developer or system administrator), ask them to update and check the site regularly, at least once a quarter.

1. List what is installed

CMS version, modules and plugins, theme, PHP version. Keep an inventory of server-side and client-side component versions. It is like taking stock of your warehouse or property. If you do not know what you run, there is nothing to update.

2. Update and remove the unneeded

• Install current versions of the system and modules, first on a test copy.
• Remove everything you do not use: disabled plugins, old themes, forgotten test pages. An unused component is just as vulnerable.
• Take modules only from official sources.

Systems differ. WordPress officially supports only the latest version and backports fixes to older ones as a courtesy. Bitrix recommends installing all updates and keeping the licence valid. Joomla publishes a feed of resolved security issues.

3. Put access in order

• A personal account for every person, no shared “admin” password.
• Two-factor authentication for administrators.
• Remove access for those who no longer work on the site: former staff and contractors.
• Unique passwords kept in a password manager.
• Access to the server, domain and control panel registered to the company owner, not to the contractor.

4. Backups

• A copy is made on a schedule and stored not on the same server.
• Both files and the database are copied.
• Once a quarter a copy is restored on a test site. That is the only way to see it works.

5. Secure connection

The site runs on HTTPS on all pages, the certificate renews automatically and HTTP redirects to HTTPS.

6. Forms and uploads

Forms are protected from spam, uploaded files are checked by type and size, and user input is processed on the server, not only in the browser.

7. Monitoring

• An alert if the site stops responding.
• Search Console connected: the search engine sends a message if it finds a problem.
• Regular review of the administrator list and recently changed files.

Signs a site may have been hacked

• Pages you did not create appear in search.
• Unfamiliar links on the site, especially hidden ones, or pop-ups.
• Visitors are redirected to other sites, particularly on mobile.
• Unfamiliar accounts with administrator rights.
• New files appear or keep appearing on the server that you did not create.
• A sudden rise in load or outgoing email.
• Warnings from the browser or search engine.

If you suspect a break-in, do not delete anything at once. Make a copy of the current state for analysis, change all passwords, close the hole and only then clean the site.

What to ask a contractor

• Who updates the system and modules, and how often?
• Where are backups kept and when was one last restored?
• Who has access to the site and the server?
• What happens when an urgent security fix is released?
• Is this included in support or paid separately?

If you have urgent problems, our website upgrade service can help.

What you can hand to us

We check a site against a large checklist (including):

• versions of the system, modules and plugins;
• unused modules;
• access;
• backups;
• monitoring.

Then we draw up a fix plan by importance. It is part of website maintenance. If you run Bitrix, WordPress or Joomla and are unsure everything is under control, write to us.