This is general educational guidance, not an assessment of your business or a guarantee of security. Check the original sources and your specific requirements before acting.
01
Limit who can sign in
Every administrator should have their own account so actions can be attributed and access can be revoked.
- Use MFA when the hosting or website platform supports it.
- Give staff and contractors only the permissions they need.
- Remove dormant users and review administrator accounts on a schedule.
02
Protect the sign-in process
Strong passwords alone do not prevent automated password guessing. Use server-side rate limiting, clear failure handling and suitable alerting. Do not use an allow-all fallback when protection storage fails.
- Check that sign-in and administration pages use HTTPS.
- Review security and access logs without collecting unnecessary visitor content.
- Ensure session cookies and sign-out behaviour are configured appropriately.
03
Keep a recovery path
Know how to regain access if an administrator, hosting login or domain account is compromised.
- Back up both site files and the database, where applicable, and test a restore.
- Keep contact details for the hosting provider and domain registrar.
- Apply software updates and retire unsupported extensions.
Source notes
Read the original guidance
The links below are from the original publishers. This article is independently written by TASII and does not imply endorsement.
- Secure your websiteASD’s Australian Cyber Security Centre · 1 July 2020 (reviewed 29 July 2024)
- Protecting devices, systems and networksASD’s Australian Cyber Security Centre · 7 October 2026
- Defending against AI-enabled cyber attacks: Guidance for small businessesASD’s Australian Cyber Security Centre · July 2026
