Security update

How often should I update my website's security?

The basic approach is to apply security updates steadily on a set schedule (for example, once a month), and to apply them right away without waiting when a serious vulnerability is announced. Think of routine checks and emergency response as two separate things.

Urgent vulnerabilities are announced by the company that makes the software or through security notices on KISA Boho Nara. If you have a maintenance provider, agree on who watches these notices and makes the call.

How often you update also depends on what your website is built with. A website with lots of plugins has more parts to update, so it needs checking more often.

You can also turn on automatic updates. If you let small security fixes install automatically and apply major version changes only after checking, you reduce both security gaps and the risk of broken pages.

What on my website needs updating?

What needs updating comes in several layers, from the server all the way to the widgets on your pages. If you don't decide who handles which layer, everyone assumes "the other side will do it," and gaps open up.

It's easy to assume a custom-built website is safe because it has no plugins. But the open-source parts (libraries) used inside it also get updates when vulnerabilities are found. Ask the developer whether they receive security alerts for these parts.

You can only update what you know is there. If you get a "list of the software and components used on our website" from your maintenance provider, you can tell right away whether a security notice applies to your site.

What's the safest order for doing security updates?

The key to a safe update is "prepare to roll back first, then check it yourself after applying it." The more common problem isn't the update itself but broken pages left sitting for days because nobody checked afterward.

If you apply long-postponed updates all at once and something breaks, it's hard to tell which one caused it. If you have a lot of updates piled up, apply a few at a time and check your pages after each batch.

1. 01Make a full backup first.
2. 02Read the update notes and check whether it's a security fix or a major version change.
3. 03If possible, apply it first in a test environment identical to your live website.
4. 04Apply it to the live website at a time when few customers visit.
5. 05Click through the front page, contact form, booking and payment yourself on both a phone and a computer.
6. 06Record what you updated and when.
7. 07If something goes wrong, roll back from the backup, find the cause, then apply it again.

What actually happens if I put off security updates?

A website with postponed updates becomes a target for automated programs that hunt for known vulnerabilities. Attackers aren't after any particular business. Their machines sweep the web for sites with unpatched weaknesses and break into whatever they catch.

Once they're in, ad or gambling pages can quietly appear where customers won't notice, or code can be planted that sends your customers to other sites. If search engines spot this, a danger warning may appear in search results or in the browser.

It gets worse if customers' personal information leaks through your contact form or member data. You may be required to notify customers and report it to the authorities, which costs far more than the time you saved by putting off updates.

Signs of a hack are hard for you to spot first. If you see unfamiliar posts under your website's name in search results, or a customer says "I clicked and it sent me somewhere else," tell your maintenance provider right away. If you connect Google Search Console, you'll get an alert when Google finds a security issue.

What security habits should I keep besides updates?

Even with perfect updates, a weak admin password is like leaving the door open. It's best to handle account management together with updates.

Several staff members sharing one admin account is another common risk. You can't tell who changed what, and it's hard to change the password when someone leaves. If possible, give each person their own account with only the permissions they really need.

Google also advises site owners to apply the latest updates and use strong passwords. The habits below cost almost nothing and make a big difference.

• Make admin passwords long and never reuse them on other sites
• Turn on two-factor authentication for your domain, hosting and admin accounts
• Delete accounts for former staff and past agencies right away
• Delete unused plugins and themes instead of just deactivating them
• Never stay logged in as admin on a shared computer at your business

What should I ask when hiring someone to handle website security?

"We'll take care of security" alone doesn't tell you what they'll actually do. Ask specifically about update frequency, emergency response, sharing records and how to reach them in an incident, and put the answers in the contract or quote.

If you already suspect a hack, tell your provider first. You can also get help from the KISA Boho Nara hotline for hacking, spam and privacy violations at 118. ISSYMO's maintenance subscription applies security updates and takes a backup every month.

• How often do you do routine updates?
• When an urgent security notice comes out, within how many days do you apply it?
• Can I get a record of the updates you've made?
• If the pages break after an update, is there an extra charge to fix them?
• If I suspect a hack, who do I contact, and how?