Most small and mid-sized business websites are not hacked by a mastermind. They are compromised by automated bots scanning millions of sites for an outdated plugin, a reused password or a form that accepts anything. That is good news, because it means the basics stop the majority of attacks. This is the checklist we run on every site we build or take over.
Lock down logins and access
Start with who can get in. We regularly find former employees, old agencies and long-departed freelancers who still hold admin accounts on client sites. Every account is a door, and forgotten doors are the ones that get forced. Review access quarterly and whenever someone leaves, and make sure hosting, domain registrar and DNS accounts belong to your company rather than an individual.
Domain names deserve special attention. We have seen businesses lose their website and email for days because the domain was registered in a former employee’s personal account or on a card that had expired. Make sure your .ae, .sa or .pk domain sits in a company account, with auto-renewal switched on and registrar lock enabled to prevent unauthorised transfers.
- Turn on multi-factor authentication for the CMS, hosting panel, domain registrar and email accounts.
- Give people only the access they need — editors do not need administrator rights.
- Use a password manager and never share one login between several people.
- Limit login attempts and move or protect the admin URL so bots cannot hammer it freely.
Keep software updated, every month
Outdated code is the single biggest risk we see. On WordPress that means core, themes and plugins; on custom builds it means framework versions and the npm or Composer packages underneath. Set a monthly update routine, test changes on a staging copy first and remove anything unused. A deactivated plugin can still be exploited if its files remain on the server.
For custom code, tools such as GitHub Dependabot, npm audit and Snyk flag known vulnerabilities automatically and open pull requests with fixes. Keep your server software current too, including PHP, Node.js and the database. Versions that have reached end of life no longer receive security patches, which makes them an easy target for the bots mentioned above.
If nobody in your business has time for this routine, a maintenance plan with your developer is usually money well spent. In our experience, a basic care plan for a business website costs from around $100 to $400 a month, covering updates, backups, monitoring and a few hours of small changes. That is far less than recovering from a breach.
Protect forms, payments and traffic
Every form is an invitation to send data to your server, so treat what arrives with suspicion. Validate and sanitise input on the server, not only in the browser, and use parameterised database queries to prevent SQL injection. Add rate limiting and a bot check such as Cloudflare Turnstile or reCAPTCHA to contact and login forms, so automated spam and password guessing stay manageable.
Never store card numbers yourself. Use the hosted payment pages or secure fields offered by gateways such as Telr, PayFort, Checkout.com or Stripe, which keeps most of the PCI DSS burden with the provider. Serve the whole site over HTTPS with automatic certificate renewal, and add security headers, including HSTS, a Content Security Policy and X-Frame-Options, to block common browser-based attacks.
Do not forget the files people upload. CV forms, document portals and image uploads should accept only the file types you expect, limit file sizes and store uploads outside the public web folder or in private cloud storage. Scan them for malware where possible, because an unchecked upload field is one of the classic ways attackers place their own code on a server.
Plan for the bad day
Even well-protected sites can fail, through an attack, a faulty update or a hosting outage. Keep daily backups of files and database, store at least one copy away from your main hosting provider and keep several weeks of history. Most importantly, test a full restore every few months. A backup nobody has restored is closer to a hope than a plan.
Set up uptime monitoring with alerts to more than one person, and use a firewall or security service that logs suspicious activity and warns you when core files change. Write a short incident plan covering who to call, how to take the site offline safely and how to tell affected customers. Having it on one page saves precious time when something goes wrong.
Security is not a product you buy once. It is a routine you keep.
Know the data protection rules
If your site collects names, phone numbers or emails, data protection law applies. The UAE has a federal Personal Data Protection Law, with separate regimes in the DIFC and ADGM free zones. Saudi Arabia’s PDPL has been enforced since September 2024 and Qatar has its own data privacy law. The UAE’s cybercrime law also covers unauthorised access to, and misuse of, personal data.
In practice, publish a clear privacy policy, collect only the data you genuinely need, get consent for marketing, encrypt sensitive information and know where your data is hosted. If you work with government or regulated sectors such as health and finance, check for local hosting requirements before choosing a provider, as some contracts insist on data staying in the country.
Cookie consent belongs here too. If you use analytics or advertising pixels, a consent banner that genuinely lets visitors decline, and that actually blocks those scripts until they agree, keeps you closer to the spirit of these laws and to the expectations of European visitors protected by GDPR.
The bottom line
Lock down access with multi-factor authentication, update everything monthly, protect your forms and payments, keep tested off-site backups and understand the data laws that apply to you. None of it is glamorous, but together these habits keep the bots out. If nobody currently owns this list for your website, that is the first thing to fix.
