Know what runs, keep it current, and prove recovery.

Inventory and ownership

• Record application, CMS, runtime, plugin, theme, and server versions.
• Remove abandoned extensions, themes, test sites, and accounts.
• Name an owner for the domain, hosting, DNS, application, and security response.
• Track supported versions and end-of-life dates.
• Document public hostnames, protocols, APIs, and administrative paths.
• Keep a private dependency and origin inventory.

Updates and compensating controls

• Subscribe to vendor security notices.
• Prioritize known exploitation and internet-facing exposure.
• Back up before consequential updates.
• Test critical login, forms, checkout, media, and API workflows.
• Use virtual patching as a bounded mitigation, not the final fix.
• Remove or isolate software that cannot be supported safely.

Accounts, secrets, and transport

• Require MFA where available.
• Use individual administrative accounts and least privilege.
• Disable stale users and unused API credentials.
• Keep secrets out of source code, tickets, analytics, and public pages.
• Use valid HTTPS at the visitor edge and verified HTTPS to the origin.
• Rotate credentials after exposure or role changes, not on an unexplained schedule that breaks clients.

Backups and recovery

• Back up files, databases, DNS, and critical configuration.
• Keep at least one isolated or independently protected copy.
• Set retention based on recovery and legal needs.
• Test restoration instead of trusting job-success messages.
• Record recovery time and data-loss objectives.
• Never treat a cache as the only backup.

Monitoring and response

1. Collect useful logs. Preserve authentication, application, WAF, origin, deployment, and administrative events with synchronized timestamps.
2. Detect meaningful changes. Alert on integrity drift, failed updates, disabled controls, unusual authentication, malware findings, and customer-route failures.
3. Contain safely. Drain affected delivery nodes, revoke local credentials, isolate shares, and preserve signed evidence before destructive action.
4. Investigate scope. Distinguish scanning, blocked attempts, vulnerable exposure, and confirmed compromise.
5. Recover from known-good state. Patch, restore, rotate affected secrets, validate the full site, and monitor recurrence.
6. Document the result. Keep timestamps, affected assets, actions, evidence hashes, and lessons learned.

Monthly evidence

• Current software and dependency inventory.
• Pending updates and approved exceptions.
• Backup and restore-test result.
• Administrative access review.
• TLS and DNS health.
• WAF and virtual-patch deployment parity.
• Integrity and failed-unit checks.
• Open incidents and corrective actions.