Website Security Basics for Marketing Sites

Who Actually Attacks a Marketing Site

It helps to be realistic about the threat. Almost nobody is targeting your brochure site specifically. What reaches you is automated: scanners looking for known vulnerabilities in common software, credential stuffing against login pages using passwords leaked from unrelated services, and bots that fill forms because a form is a free channel to somebody.

That matters because it tells you where to spend effort. You are not defending against a determined human adversary who will adapt. You are trying to be a slightly harder target than the automated sweep expects, and that is a much more achievable goal.

Accounts Are the Most Common Way In

The single largest category of compromise we see is not clever. Somebody reused a password, the account had more permission than it needed, and the person left the company eight months ago without anyone removing access.

Fix that first, because it is free. Turn on two-factor authentication for every account that can change the site, the domain or the analytics. Give people the least permission that lets them do their job — an editor does not need administrator rights. And put an offboarding step in your process so leaving the company removes access on the same day, not whenever someone remembers.

The Accounts People Forget

The website login is the obvious one. The dangerous ones are the accounts nobody thinks of as part of the website: the domain registrar, the DNS provider, the email service, the payment gateway, the analytics property, and whichever personal account the original developer used to set something up in 2019. List them, name an owner for each, and check they are not tied to an individual’s private email address.

Keeping Dependencies Current

Every plugin, theme and library is code you did not write running on your site. Most compromises of common platforms come through a known vulnerability in an outdated component, patched months earlier by its maintainers, that nobody applied.

Two habits handle most of this. Update on a schedule rather than when something breaks, and remove anything you are not actively using — a deactivated plugin is still code sitting on the server. Fewer components is a security posture, not just a performance one, and it fits naturally into the routine described in our guide to website maintenance.

Give the update job to a named person with a recurring slot in their calendar, and always apply updates somewhere safe first if the site earns money. The failure mode teams fall into is the opposite extreme: a bad experience with one update leads to updating nothing for a year, which is far more dangerous than the occasional broken layout you can roll back in ten minutes.

Forms, Spam and Abuse

Any public form will be found and used. Most of what arrives is spam, which is an annoyance, but forms can also be abused to send mail through your domain, to probe for injection flaws, or simply to bury a real enquiry under two hundred fake ones.

Rate limiting, a non-intrusive challenge, server-side validation of every field, and an upload policy that restricts file types cover the majority. Resist the temptation to solve it with a harder form, because you will lose real enquiries in the process — the trade-off we work through in form design that people actually complete.

Hosting Is Part of Your Security Posture

Where the site runs decides how much of this is your problem at all. A managed platform that handles patching, isolation and certificate renewal removes several categories of risk from your list entirely. A cheap shared server where a neighbouring site can affect yours, running a version of the runtime that stopped receiving security updates two years ago, adds categories you cannot see and cannot fix.

Ask three questions of any host before you commit: who applies security updates and how quickly, whether sites are isolated from each other, and what the documented process is when something goes wrong at three in the morning. A host that cannot answer those clearly is a risk you are taking on behalf of your customers as well as yourself.

Third-Party Scripts Are Your Risk Too

Marketing sites accumulate tags: analytics, chat widgets, heatmaps, ad pixels, A/B tools, embedded video. Each one runs with the same access to your page as your own code. If one of those vendors is compromised, the script they serve you is compromised, and your visitors are affected on your domain.

Keep an inventory of what is loaded and why, remove the ones nobody uses any more, and require a named owner before anything new goes on. This is also a privacy obligation as much as a security one, since each of those scripts is potentially collecting data you are responsible for disclosing.

Backups You Have Actually Restored

A backup you have never tested is a belief, not a control. At least once, restore into a staging environment and confirm you get a working site with current content. Check what the backup includes — database, uploaded media, configuration — because partial backups are common and are discovered at the worst possible moment.

Domain and DNS: The Quiet Catastrophe

The most damaging incidents are rarely on the website itself. Losing control of the domain means losing the site, the email and the ability to prove you are you. An expired registration or a hijacked registrar account is far more consequential than a defaced page.

Enable auto-renewal, turn on registrar lock and two-factor, keep the registrant contact as a company address rather than one employee’s inbox, and set a calendar reminder for the certificate and domain expiry dates independently of any automated notice.

Notice a Problem Before Your Customers Do

Most compromises are discovered late, usually by someone outside the company. Uptime monitoring, a weekly look at whether search results for your brand show anything unexpected, and an alert when core files change will surface the majority of incidents while they are still small. None of this needs a security budget; it needs somebody to be responsible for looking.

Agree the response in advance too. Who takes the site offline if it is serving something harmful, who talks to customers, and where the backups are. Deciding that during an incident, at speed, with an audience, is how small problems become public ones.

Knowing When to Call Someone

Everything above is within reach of a competent marketing team, and it covers most of what actually happens. There is a line, though. If you handle payment data directly, hold sensitive personal information, operate in a regulated sector, or are already dealing with an active compromise, that is specialist territory and you should treat it as such rather than improvising.

Write down who you would call before you need to, and make sure someone other than the person on holiday knows where the credentials and the hosting contract live. If you want the routine parts built into your site and your process from the start, our web team treats access, updates and backups as part of the handover rather than an optional extra, and the same applies to any ongoing platform work we take on.