Numuno Digital /
Small-business website security: what to check with your provider
A business website needs to keep working after launch. Start with who can access it, what is maintained and how the service can be recovered. Use these questions to review your situation and prepare a useful conversation with your provider.
By Numuno Digital, an independent web design and marketing studio in Marbella.
Make responsibility visible
List the domain, hosting, website platform, access holders and connected services. Include forms, booking and email. A website can remain visible while one of those services stops working. Ask your provider what they maintain, what they check and how an incident reaches the right person.
INCIBE recommends assessing risk and assigning continuity responsibilities. Apply that principle to your business: who handles the website, who handles the booking service and who can recover access? Define these tasks in the proposal instead of assuming that hosting includes every kind of support.
Review access and updates
Use distinct credentials and enable two-step authentication where available. The WordPress security handbook recommends strong passwords and this additional check. Identify which accounts need to publish content and which need configuration access, and agree how former collaborators lose access.
WordPress core, themes and plugins require maintenance; its handbook recommends trusted sources and removing unused plugins. Custom development also needs a named owner for component updates. Ask how changes are tested and reversed, and how urgent security notices are handled. A tool cannot promise complete protection.
Check recovery, not just the existence of backups
INCIBE’s website-protection dossier recommends copying the elements needed to recover a site, storing backups separately from the original and verifying restoration. Include the database where there is one.
Ask what is copied, the frequency, retention and who can restore it. Request the date and result of a test in a separate environment. Set the schedule around the information your business can afford to lose. Restoring pages does not establish that a third-party booking service has recovered its records.
Check the secure connection and contact journey
MDN explains HTTPS as HTTP protected by TLS, encrypting communication between browser and server. This protects data in transit; it does not certify that every website component is free of vulnerabilities.
Test important pages and actions on a phone and computer. Report browser security warnings rather than working around them. Ask the technical provider to check the certificate, renewal, redirects and loaded resources. With the person who receives enquiries, arrange a controlled delivery test using test data.
Respond to incidents with evidence
Record when the problem appeared, affected functions and visible warnings. Contact the responsible technical provider to contain the issue and preserve relevant records. Avoid erasing evidence before assessment.
In Spain, AEPD guidance requires personal-data breaches to be documented. Notification to the authority is required unless a risk to people’s rights and freedoms is unlikely; when required, notify without undue delay and where feasible within 72 hours of the controller becoming aware. Ask the person responsible for data protection to assess the circumstances.
Include handover and continuity in the website brief
Request clear domain control, business access, change procedures, backup arrangements, support and an exit process. Separate launch work, ongoing maintenance and SEO. Do not assume that a design proposal includes all three.
Numuno Digital agrees pages, functions and project conditions before starting. Share your existing website and what you need to preserve when requesting a redesign. Maintenance responsibilities should be defined in the proposal, while ongoing search research and improvement have their own SEO scope.
Start by gathering provider contacts, important website functions, access holders and the information you cannot afford to lose. A new visual design alone is not evidence that an underlying security problem has been resolved.
Reviewed on 28 October 2026 against INCIBE, WordPress, MDN and AEPD documentation. General project-planning guidance; specific measures and obligations depend on the site and data processed.
Your checklist before starting.
- Domain, hosting, platform and provider contacts recorded
- Access holders, permissions and recovery reviewed
- Updates and changes assigned to a responsible provider
- Backup coverage, retention and restoration checked
- HTTPS and the contact journey reviewed
- Maintenance, incidents and handover documented