01The invisible breaks too
Nobody visits your website to admire the security certificate or last night's backup. But if they fail, nothing else matters: the website doesn't load, the browser warns that it isn't secure or emails don't arrive.
The good news is that almost all of this can be sorted once and then just needs watching.
02The domain: yours and renewing itself
The domain is your address on the internet. It looks like a formality, and it's the piece that causes the most scares.
- In your company's name. Not the IT person who registered it years ago, nor the previous agency.
- With access to the registrar account. You or someone on your team, not just a supplier.
- With automatic renewal and a card that doesn't expire without anyone noticing.
- Alerts to an inbox someone reads. Renewal reminders sent to a forgotten address are no use.
03Backups that actually work
Having backups isn't the same as being able to recover. A useful backup is:
- automatic and frequent, at least daily if the website changes often;
- stored off the server, because if the server fails, the backup that lives on it fails too;
- kept in several versions, so you can go back to before a mistake it took you days to spot;
- tested. A backup that has never been restored is a hope, not a backup.
A classic rule sums it up well, 3-2-1: three copies, on two different media and one of them off-site.
04The padlock in the browser
The SSL certificate is what makes your website run over https and the browser show the padlock. Without it, the browser warns your visitors that the website isn't secure, and almost nobody carries on.
The most widely used free certificates expire every few months and renew themselves, as long as someone has set it up properly. It's worth checking and having an alert in case the renewal fails.
05Updates: small and often
If your website uses a content management system, its plugins and theme need updating. Outdated plugins are one of the most common ways in for attacks.
The recipe is simple: update often, with a backup taken just before and, if the website is important, testing first on a staging copy. Lots of small updates are less frightening than one big one every two years.
06Knowing it's down before your customers do
A monitoring service checks your website every few minutes and alerts you if it doesn't respond. It's cheap and it changes the story: you find out, not your customer.
And while you're at it, check your email. Your domain needs three properly configured records (SPF, DKIM and DMARC) so your emails don't end up in the spam folder and nobody can easily pretend to be you.
What matters isn't that nothing ever fails. It's that you find out first and have a way to fix it.
07Access: who has the keys
- A list of every login: domain, hosting, website, email, analytics and ads.
- Named user accounts, not one password shared by the whole team.
- Two-step verification wherever possible.
- And removing access for anyone who stops working with you, the same day.
08A checklist for today
If you only have ten minutes, check this:
- Is the domain in your company's name and does it renew automatically?
- Do you know where the backups are and when the last one was tested?
- Does your website load with the padlock on every page?
- When was it last updated?
- Would anything alert you if it went down tonight?
- Do your emails land in the inbox and not in spam?
- Do you know who has access to what?
If any answer is “I don't know”, you know where to start. In infrastructure and maintenance we explain how we put everything in order, and how we keep watch afterwards.
