A website can look unchanged while the software and services behind it keep moving. Care needs to cover what is running, who can access it and whether the important tasks still work after a change. The starting point is the actual platform and the way your business uses it.
Establish what needs maintaining.
A WordPress store, a static brochure site and a custom enquiry tool have different maintenance needs. Record the software, integrations, licences and external services involved. Identify which provider manages each part and which responsibilities remain with the business or its developer.
WordPress documents updates as part of its security guidance. Australian cyber security guidance also recommends keeping website software and plugins current. That advice needs a practical process suited to the site, including access, a recoverable copy and a way to check important functions.
Reading behind this section: WordPress; Australian Signals Directorate
Check the tasks an update could affect.
Before a substantial update, identify the journeys that depend on the component being changed. A shop may need product selection, checkout and order notifications checked. A service business may need its enquiry form, attachments and staff notification checked instead.
Use a separate test environment where appropriate, then verify the live result. Record what changed and what was checked. An update report becomes more useful when it explains whether the relevant customer tasks were tested, rather than only listing new version numbers.
Make secure access manageable for the team.
Give people access suited to their role and remove access when it is no longer required. Australian guidance recommends multi-factor authentication for website administrators. Keep the recovery method available to the right person so an unavailable phone or former staff account does not become a surprise.
Troy Hunt explains why unique passwords and password managers matter. For a business, this means having a secure, usable way to manage credentials rather than relying on a shared password from an old email. Review access to hosting and domain accounts alongside the website login.
Reading behind this section: Australian Signals Directorate; Troy Hunt
Agree how routine and urgent work are handled.
Clarify who reviews available updates, what gets tested and how an urgent issue is reported. A routine update allowance may be different from repairing an unsupported extension, rebuilding an integration or investigating a compromise. Those boundaries belong in the care agreement.
Start with the components and access already in place. Ask for the next recommended action, its reason and its priority. That gives the owner something concrete to decide without needing to interpret a long software inventory.
Put it to use
A useful check for your business.
- Identify the platform, integrations and responsible providers.
- Agree the update process and relevant functional checks.
- Review administrator access, MFA and account recovery.
- Define how urgent issues and separate work are handled.
The thinking behind this guide
Sources & further reading.
Our practical interpretation, with the references below for the specific principles and further detail.
- Hardening WordPress
Updates, access controls, backups and monitoring form parts of WordPress security; no security guarantee.
- Secure your website
Current software, MFA for administrators and access limited to the role required.
- Passwords Evolved: Authentication Guidance for the Modern Era
Unique credentials and usable password-manager support; historical practitioner explanation alongside current official guidance.
