Tips by lifecycle stage
Keep doing this — a site is never finished — 16 tips at this stage.
Keep the domain in a company-controlled account, secure registrar and DNS logins with strong MFA, enable transfer or registry locks, keep recovery and billing contacts current, and run DNSSEC carefully.
Put every critical web account in the business's name with named administrators, MFA, independent recovery routes and monitored billing, keep an account inventory, and remove access when people or suppliers leave.
A maintainable website has one clear source of truth, reuses shared elements instead of copying them, and has a documented way to test, deploy and undo changes — with dependencies recorded and content exportable, so another competent person can safely take over.
Back up everything needed to rebuild the site at a frequency set by how much data you can afford to lose, keep independent encrypted generations, monitor the jobs, and periodically restore the complete site into a protected test environment — a backup is proven only when it recovers a clean, working system.
Run frequent external checks from several locations that verify real content, add a browser-based check of the function your business depends on (safely), watch TLS and domain renewal, monitor internal warning signs where you can, and send confirmed alerts to a named person through more than one channel.
Audit the real attack surface — exposed software, server and app configuration, identities and sessions, every input and upload path, and third-party dependencies — then fix and recheck on a schedule and after every incident or advisory.
Make your privacy notice match reality — the data you actually collect, the third parties you use, how long you keep it, and how users exercise their rights — in plain language, with prior consent for non-essential cookies and similar technologies where required.
Keep the CMS, plugins, runtimes and every maintained layer updated on exploitation-aware priorities, remove confirmed-unnecessary components, apply least privilege with phishing-resistant MFA, and treat every control-plane account as an admin login.
Collect only the data you genuinely need, delete it when you're done, know which third parties receive visitor data, and get prior consent before setting non-essential cookies or trackers.
Treat inbox placement and abuse resistance as separate jobs — verify aligned authentication, protect sending reputation, run a secure accessible contact form to a role alias, and assume any published address can be harvested.
Before you relaunch, inventory every old URL from multiple sources, keep unchanged URLs in place, map each changed one to its closest new equivalent with a permanent redirect — then verify the old inventory directly and keep the map for years.
Reply to every legitimate inquiry promptly and reliably — acknowledgments that follow real acceptance, a tracked shared workflow with owner and backup, and end-to-end delivery checks — so no inquiry is lost to delay or mishandling.
Label campaign links with UTM parameters so analytics can associate recorded visits and conversions with campaigns — one lowercase documented convention, links tested end to end, internal links and personal data left out.
Run a permission-based newsletter on valid recorded consent (or a genuine soft opt-in), with an easy free unsubscribe honored promptly, relevant accessible content, and aligned authentication — the compliance stays yours even with a sending service.
Publish genuinely useful, well-organized content on the topics you know best — discoverable, honestly sourced, linked into a real hub — to improve the odds people bookmark, cite, and find your site.
Claim and accurately complete your Google Business Profile (if eligible), keep your public business details materially consistent everywhere — without exposing a private address — and use a reliable, answered number for areas you genuinely serve.
