Securing your website: the basic steps

People readily think a small website interests nobody. Yet a guessed password is all it takes for a page to change its content, or a hijacked domain name for the site to become unreachable. And an attack can do without any technique at all: a simple message asking for a code or a payment is enough.

Here are the basic steps, ordered from the most obvious to the most forgotten. Most are done only once.

HTTPS everywhere, and a certificate that renews itself

HTTPS encrypts exchanges between the visitor and your site: what they type into your contact form doesn’t travel in the clear. Cybermalveillance.gouv.fr recommends serving the site over HTTPS only, and some browsers flag sites that don’t.

Check three things:

• your site’s address starts with https and the browser shows no warning;
• the old http address, without the s, redirects on its own to the secure version;
• Search Console’s HTTPS report flags neither an invalid certificate, nor a page that redirects to the non-secure version.

The certificate, which vouches for the site’s identity, has an end date, and its lifetime is getting shorter. The CA/Browser Forum, which sets the rules for certificates, adopted in 2025 a stepwise reduction of their maximum lifetime: from 398 days to 47 days, between March 2026 and March 2029. Renewing by hand will no longer be workable. Ask your host whether renewal is automatic.

Long, unique passwords, and a second lock

The CNIL gives three benchmarks of equivalent strength: at least 12 characters mixing upper case, lower case, numbers and special characters; at least 14 characters mixing upper case, lower case and numbers; or a passphrase of at least 7 words. Cybermalveillance.gouv.fr adds a different password for each service, and a password manager to remember them for you.

Start with the accounts that open the others:

1. Your email, which is used to reset everything else. Cybermalveillance.gouv.fr counts it among the most important passwords to protect.
2. The registrar of the domain name, and the host of the site.
3. The Google account that manages your business profile.
4. The business’s social media.

On each one, turn on two-factor authentication: at each login from a new device, a code received on your phone, or an app, confirms it really is you. The CNIL considers these solutions more protective than a password alone, and Google recommends it for the account that manages the profile.

At the slightest doubt, change the password right away, and everywhere you had reused it.

Updates, as soon as they come out

If your site runs on a content management system (a CMS) with plugins, every update can fix a flaw. Cybermalveillance.gouv.fr recommends installing them as soon as they are available, automatically when possible, and backing up just before. For plugins:

• install only the ones you use, and remove the others;
• download them only from the official source;
• be wary of a plugin that hasn’t changed in years: it is probably no longer maintained.

The same reflex applies to the computer and phone you manage the site with. Also limit access: one account per person, admin rights kept to the strict minimum, and former collaborators removed on the day they leave. Google recommends this for the business profile, and Cybermalveillance.gouv.fr for the site.

Backups, and a restore you have tried

A backup is only worth something if it restores. Cybermalveillance.gouv.fr recommends regularly backing up the site, its configuration and its data, checking that the copy can be put back in place, keeping one in another location, and unplugging the storage after use so that an attack can’t reach it.

In practice:

• ask your host what it backs up, how often, and how long it keeps the copies;
• keep the originals of your texts and photos on your side;
• once a year, restore the site from a copy, at a test address.

The domain name: in your name, renewed, locked

A hijacked domain name can divert your visitors or make the site unreachable, Afnic warns. Four checks, to do at your registrar (see also choosing a domain name):

• The holder. You, or your company, must appear in the directory of holders, the Whois. Afnic cites two frequent cases: the provider who registers the name in their own name for convenience, and the employee who registers it in theirs and then leaves the company.
• The expiry date. Automatic renewal on, card up to date, and a contact address that works. Preferably take it outside that domain: if the domain goes down, the emails that should have warned you go down with it.
• The lock. For a .fr, Afnic offers .FR Lock, which blocks any technical change to the name without your consent; you request it from your registrar. Cybermalveillance.gouv.fr recommends this lock, and DNSSEC, a signature that prevents your site’s address from being forged along the way.
• The transfer code. This code, called “auth-info”, lets you move the name to another registrar. Only give it to the one you have chosen.

Phishing aimed at owners of websites and profiles

Your domain name and your Google profile are public: scammers know them. The traps to recognize:

• The fake expiry notice. A letter or an email looks like a renewal invoice for your domain. Afnic has described this trap: by paying, you actually sign the transfer of the name to an unknown provider. Only renew at your registrar, typing its address yourself.
• The fake call from Google. Someone offers to keep, verify or improve your profile for money. Google is clear: the profile is created free of charge, it never asks for bank details by phone, nor for a one-time code. Hang up, without pressing any key.
• The request for access to the profile. Don’t accept an invitation to manage your profile from someone you don’t know.
• Review blackmail, which threatens your rating: see replying to reviews.

The reflexes, according to Cybermalveillance.gouv.fr: check that the sender writes from the organization’s domain name; hover over a link without clicking to see where it leads; check through another channel, with the number you already know. No serious organization will ask for your password.

If you clicked, or gave a code:

1. Change the password right away, and everywhere it was used.
2. Keep the message, as evidence.
3. In France, report emails to Signal Spam and text messages to 33700.
4. File a complaint. In France, Info Escroqueries answers on 0 805 805 817, free of charge, to help you.

In short: HTTPS with a certificate that renews itself, long and unique passwords backed by two-factor authentication, updates without waiting, backups whose restore you have tried, a domain in your name and locked, and systematic doubt toward any message asking for a code or money.