Who Owns Your Website's Security?

“Marketing handles the website”

Some companies split their technology. IT runs email, SharePoint, the network, and the laptops. Marketing manages the website.

On the surface it makes sense, as marketing is just making content updates. But marketing folks typically aren’t security experts (and vice versa.)

I’ve worked with companies that have IT departments that handle internal company security, but leave the public website security up to the marketing department. (I’ve also worked with companies that had no one watching website security.)

“But, we don’t collect any sensitive data”

Sometimes the reasoning is they have a brochure site with a contact form that asks nothing more than a name and email address.

Problem is, visitors need to trust the links on your site. If you’re linking to a customer portal, payment page, a banking login of any type, folks click those links expecting they are safe.

Someone who hacks your site can change where those links point to.

“OK so what’s that look like?”

• The login button now goes to a phishing site.
• A domain that looks like yours.
• A page that is designed identical to yours.
• But it is not yours, a hacker owns it.
• Someone types in their username and password…you can see where this is going.

“What are other examples?”

There’s plenty of other examples of hack types… two of them are:

• Malware. Attackers inject malicious code into your pages and every visitor is now a potential victim.
• SEO spam. Attackers add new pages, links, that may link to something like a casino site, a pharmacy site, etc. Suddenly search engines index them.

Both damage the brand, and search engines can flag or demote a site that’s serving either.

“How does this happen?”

• Account Security Sometimes it’s an account lacking two factor authentication and/or a secure password, or a leftover account from a previous employee / contractor / vendor that no one removed.

• Website software security Software left out of date. (E.g., if you run a WordPress site and haven’t kept up with core and plugin updates.)

• Server Software security Sometimes, it’s something out of your control, like the server software itself, if you’re using a managed web host. On October 21, 2026, PHP released fixes for two severe vulnerabilities (PHP2Shell) that let an attacker run code remotely without needing to log in. Every PHP installation that serves web requests was affected until it’s patched, and Amazon recorded an exploitation attempt four days before the flaws were even made public.¹

“So, what do I do about it?”

I handle security for lots of sites: banks, fintech, ecommerce, brochures, and everything in-between. I apply the same practices to all of them.

• Enforce multi factor authentication on every account that can modify the site. That includes the CMS and the hosting control panel.
• Regular access reviews. Remove former employees, contractors, vendors, and anyone else who should no longer have access.
• Regular log reviews. Who is logging in? And from where? If an admin logs in from an unusual spot (e.g. overseas) are you getting an alert?
• Use least privilege. Folks editing content don’t need administrator access. An outside agency building a landing page doesn’t need entire site access.
• Keep everything updated. That means the CMS, plugins, themes, and the server software underneath them.
• Monitor file changes. File integrity monitoring can catch modified code, so unauthorized changes can be caught hopefully before a customer even sees it.
• Regular malware scans. Best not to wait until something is wrong.
• Staging deployments. Don’t let folks edit your live website directly. Use a staging site for everything from testing software updates to content changes. Then shortlist folks who have authority to push the changes live.
• Test your backups. Do you have backups? Are they working? Are they off-site? Does restoring them work? Backups are your lifeline in the worst case scenario.

Website security is not one-and-done. It is a proactive, ongoing process. If you’re not taking it seriously, you’re leaving your business at risk.