Start with three questions: who can access the accounts behind your website, who keeps its software current, and who could restore it if something went wrong?
If the answer to any of those is “I think the old web developer handles it”, find out now. A website can look fine while its access and maintenance arrangements have been forgotten.
This guide is for business owners checking those arrangements with a supplier. If your site is already compromised, contact your hosting provider or an incident-response specialist. A redesign is not the first step in containing an active incident.
Check the accounts that control the site
Your website login is one account to protect. There may also be separate accounts for the domain registrar, hosting, business email and any connected booking or payment services.
Work out which accounts belong to the business and which belong to a supplier. Confirm how the business would recover access if a staff member or contractor became unavailable. Use individual logins where the service supports them, and remove access that is no longer needed.
Turn on multi-factor authentication for accounts that offer it, especially email and the domain registrar. Use a unique password for each account and keep recovery information somewhere the right person can retrieve it securely. The Australian Cyber Security Centre explains the available methods in its multi-factor authentication guidance.
A useful question for your supplier is: “If you were unavailable tomorrow, which accounts could we still access, and who would help us recover the rest?”
Make someone responsible for updates
Software updates can include fixes for known security flaws. the Australian Cyber Security Centre's small-business guide explains why installing them matters.
For a WordPress site, ask who maintains the core software, plugins and theme. For a custom site, ask who maintains the libraries, hosting configuration and connected services. Moving away from plugins changes the maintenance work. The new software will still need attention.
Ask for the responsibility to be written into the agreement. Find out how updates are tested, how urgent fixes are handled and what happens if an update breaks an important feature. “Hosting included” does not answer those questions by itself.
Check what a backup would actually recover
Ask the person responsible to explain the restore process. Which parts of the site are covered? Are uploaded files and customer records included? How recently was a restore tested?
A copy of the website's design files will not necessarily recover bookings, orders or enquiries held in another service. Make a short inventory of where the important information is stored, then check the backup arrangements for each part.
The Australian Cyber Security Centre's backup guidance covers backup options and protecting the backup itself. For your website, the practical test is whether someone can restore the information you would need to keep operating.
Do not test a restore over the live site. Ask your supplier to demonstrate it in a separate environment and explain any gaps.
Test the enquiry path as well as the homepage
An available homepage does not prove an enquiry reaches the right person. Check the form, the confirmation a customer sees and the destination that receives the submission.
Arrange a labelled test with the person responsible. Use test details rather than real customer information. Confirm that the enquiry arrives once, that it can be recognised as a test and that a failure gives the customer a useful message. If it creates calendar invitations or emails other people, agree the test before running it.
Ask your supplier how the form handles spam and unexpected input, and what information it stores. A CAPTCHA is one possible control. It does not explain the rest of the form's behaviour or the access rules around customer data.
Be precise about what “secure” means
A padlock indicates an HTTPS connection. It does not tell you whether accounts are protected, software is maintained or someone has tested recovery.
“Monitored” might mean the homepage is checked for availability. It might include alerts when an important workflow fails. Ask what is checked, who receives the alert and what happens next.
At noboringsites, the scope of hosting and maintenance belongs in your plan and project agreement. We do not provide incident response or malware cleanup. If you are replacing a site after an incident, get the incident contained first, then discuss the rebuild and migration.
A short checklist for your next supplier conversation
| Ask | What you need to understand |
|---|---|
| Who controls the domain, hosting and email accounts? | The account owner, recovery route and current access list |
| Who applies updates? | The responsible person or service, the process and its limits |
| What does the backup include? | The files, records and configuration covered, plus any gaps |
| When was restoration last tested? | The date of the restore test and the information recovered |
| What happens when a form stops working? | How the fault is noticed and who acts on it |
| What happens when we leave? | The handover process and what another supplier would need |
Keep the answers with your business records. Review them when a supplier, staff member or important service changes. The ACSC's small-business guidance is a useful starting point for the wider business beyond the website.
Maintain it or replace it?
If the website works well and the maintenance responsibilities are clear, a rebuild may not be necessary. Resolve the specific problem first.
If the site is difficult to manage, no longer fits the business or needs a different customer workflow, a rebuild is worth considering. Read our WordPress replacement comparison and migration overview to see what that involves.
For a new website or a rebuild, book a free intro call. Tell us what the site needs to do and what is creating work for your business today.
Want this done for you?
We build custom sites, sell templates you can put live today, and host and look after both.