Website security: what should you look out for?

Website security is rarely about hackers targeting your company specifically. Most attacks come from automated bots that scan the entire internet for known weak spots: outdated software, weak passwords, forms that accept anything. If your foundation is in order, those bots move on straight away. In this article we list what to look out for, from HTTPS to monitoring, and what you arrange yourself and what your platform does for you.

Why would anyone want to hack my website?

Because your website is worth something, even if your company does not seem interesting to attackers. They are rarely after you personally. They want to use something your site has:

• Your server's processing power, for example for a botnet.
• Your visitors, whom they redirect to phishing or malware.
• Your positions in search engines, by placing hidden spam links in your pages.
• Data from your database, such as email addresses and login details.
• Your availability, to extort you afterwards.

The consequences often only become visible later: a warning in Google, a mail server that ends up on a blacklist, or customers asking why your site sent them to a strange page.

Is HTTPS enough for website security?

No, HTTPS is the minimum, not complete security. An SSL certificate (technically TLS) encrypts the connection between visitor and website. Without that encryption, someone on the same network can read what is being sent: form data, login details, payments.

Check three things:

• The whole site runs on HTTPS, not just the checkout or login screen.
• HTTP is automatically redirected to HTTPS.
• The certificate renews automatically, so it never expires.

Browsers mark sites without HTTPS as not secure, and visitors drop off straight away. On Webflow this is arranged by default. On self-hosted platforms you have to set it up and monitor it.

Why are updates so important for security?

Because most hacks exploit vulnerabilities for which a fix already exists. As soon as a vulnerability in a CMS, plugin or server package becomes known, an update is released. At that moment attackers also know where to look. They scan the internet for sites that have not installed the update yet.

On platforms where you manage everything yourself, such as WordPress, that means keeping the core, theme and every plugin up to date, and removing unused plugins and themes. Not now and then, but structurally. If you do not want to do that yourself, put it in an agreement for maintenance and security.

On a managed platform such as Webflow, platform updates happen centrally. What you do monitor yourself is the code you add: external scripts, embeds and integrations with other systems.

How do you set up access control properly?

By giving as few people as possible as few rights as possible, with strong and unique login details. Attackers automatically try thousands of combinations of usernames and passwords. A predictable password will not hold that off for long.

• Use a password manager and a unique password per account.
• Turn on two-factor authentication for your CMS, hosting, domain registration and email.
• Only give admin rights to those who really need them. Editors usually have enough with editing rights.
• Remove accounts of former employees and external parties as soon as their work is done.

Do not forget the accounts around your website. Anyone with access to your domain registration or DNS can redirect your entire site, however well the CMS itself is secured. The same applies to phishing: an email that appears to come from your hosting provider and asks for login details is still one of the most commonly used ways in. If in doubt, check via a channel you know yourself.

What kind of backups do you need?

Backups that are made regularly, stored outside your website and demonstrably restorable. A backup does not prevent a hack, but it determines how much damage a hack does. With a clean version from before the break-in, you roll back and lose at most recent changes. Without a backup, you have to track down malware by hand, and then you often miss something.

• Make daily backups of sites that change often, weekly backups of more static sites.
• Keep several versions, because a hack is often only discovered later.
• Store backups in a different place from the website itself.
• Test restoring. A backup that has never been tested is an assumption.

Webflow automatically keeps versions of your site that you can restore. Data that lives outside Webflow, such as a database behind an application, needs its own backup strategy.

Why are forms a risk?

Because every input field is a way in for data you do not control yourself. Two well-known attacks show why.

SQL injection

Someone enters database commands in a form field. If the back end does not handle that input properly, the attacker can read or change data.

Cross-site scripting

Someone places a script in input that is later shown to other visitors. That script then runs in their browser, with all the consequences that brings.

With the standard forms of a mature platform, this is largely covered. With custom work, such as a client portal or your own system integrations, input validation, parameterised queries and output escaping are part of the build. Also add rate limiting and a captcha or honeypot against spam and abuse.

How do you know if your website has been hacked?

By actively monitoring, because many hacks are invisible to the owner. Spam links, for example, are only shown to search engines, and malicious redirects sometimes only to mobile visitors.

• Have an uptime monitor check whether your site is reachable.
• Use Google Search Console, which warns you of security issues on your domain.
• Keep track of failed login attempts and get alerts for anomalies.
• Scan self-hosted sites for malware periodically.

What do you do if your website has been hacked?

First limit the damage, then restore, then close the vulnerability. In that order:

1. Change all passwords: CMS, hosting, database, FTP and email.
2. Take the site offline temporarily if necessary.
3. Restore a clean backup from before the hack.
4. Find out how the attacker got in and close that vulnerability.
5. Scan for remaining malware and check whether Google still marks your site as unsafe.

Do not skip step four. If you only restore the backup, you are open to the same vulnerability again.

Which platform do you choose if security weighs heavily?

A platform where as little as possible depends on you. The more components you have to maintain yourself, the greater the chance that an update gets left somewhere. A managed platform takes over hosting, updates and certificates. A self-hosted CMS gives more control, but also more responsibility. In Webflow vs WordPress security we set out that trade-off in detail.

Whatever you choose, security is not a one-off job. We build websites with Webflow development as the foundation and help companies that want to move away from a self-hosted CMS with a WordPress migration. Want to know how your site is doing? Get in touch.