Blog Single
Website Security Checklist for South African Organisations
Convert technical precautions into owned, tested controls that protect customers and business continuity.
Treat the website as an operating service
A South African website may support sales, payments, applications, customer service and reputation. Its security therefore belongs in business governance, not only in a developer’s maintenance queue.
Apply controls according to data sensitivity, transaction value, exposure and recovery needs. A public brochure site has a different impact from a portal or store, yet even a simple site can distribute false information or collect customer details when compromised.
OWASP’s 2025 Top 10 highlights categories such as broken access control, misconfiguration, software supply-chain failure, insecure design, authentication failure and inadequate logging. Use it to frame discussion, then assess the actual architecture and workflows rather than ticking category names.
Establish governance and a complete service map
Groups with several brands or agencies should map inherited access carefully. A forgotten microsite can become the easiest route to customer deception even if it has no current campaign.
Keep registrar, DNS and hosting ownership under organisational control. Require at least two appropriately authorised recovery contacts without creating unnecessary administrators.
- Appoint a business owner who accepts risk and a technical owner who operates controls.
- Inventory domains, DNS, hosts, WordPress sites, staging environments, themes, plugins, code repositories, email delivery, payments, analytics and integrations.
- Record provider, account owner, administrators, billing contact, renewal and support route.
- Identify data types, business processes and customer journeys dependent on each site.
- Define service availability, recovery time and tolerable data loss.
- Maintain an escalation register outside the website itself.
Control identity from hire to offboarding
Inspect accounts used by applications, deployment tools and connectors. Service credentials often escape ordinary staff reviews and may retain broad rights long after an integration changes.
Avoid keeping permanent emergency access active for convenience. If a break-glass account is justified, protect it strongly, monitor use and test the access procedure without disclosing credentials broadly.
- Create named accounts and prohibit shared administrator credentials.
- Require unique passwords through an approved manager and multi-factor authentication.
- Allocate WordPress, hosting, DNS, payment and analytics roles by job need.
- Separate publishing, user administration, billing and customer-data export.
- Review privileged accounts and partner access regularly.
- Remove access immediately when employment or supplier work ends.
- Protect password-reset and MFA-recovery processes.
Manage WordPress and Elementor dependencies
WordPress recommends running its latest version and creating a backup before updating. The operational process must also cover compatibility testing, deployment evidence and failure response.
Do not use pirated or “nulled” plugins. Beyond licensing concerns, their origin and integrity cannot be relied upon. Evaluate small add-ons with the same care as large platforms because their code operates inside the application.
- List WordPress core, the active theme, plugins, custom components and external scripts.
- Assign an owner and reason for every dependency.
- Obtain extensions from trustworthy sources and preserve licence provenance.
- Monitor vendor notices and supported versions.
- Remove inactive, abandoned and duplicate functionality.
- Trial significant updates in staging and verify representative workflows.
- Keep a documented rollback route.
Verify infrastructure and configuration
Clarify responsibility between host, managed-service provider, development agency and internal team. A provider may secure infrastructure while the client remains responsible for weak WordPress roles or vulnerable custom logic.
Review caches, proxies and content delivery settings to ensure private or account-specific pages cannot be served to the wrong visitor. Security configuration should be tested after material hosting changes.
- Use supported server, database and runtime versions.
- Enforce HTTPS across pages, administration and integrations.
- Limit control-panel, database, file-transfer and shell access.
- Protect configuration, environment, backup and log files from the web.
- Remove default accounts, unused services, sample applications and directory browsing.
- Keep production secrets separate from development and staging.
- Set suitable file ownership and write permissions.
- Review DNS, email authentication and certificate renewal.
Make recovery demonstrable
Elementor’s current guidance recommends testing a backup in staging to confirm it retained the website. Restoration should include forms, media, templates, scheduled jobs and integrations, not only the homepage.
Plan how transactions between the last copy and an outage will be reconciled. Recovery of an online store may need order and payment evidence from external providers before normal service resumes.
- Back up the complete application state, database and required configuration.
- Select frequency using transaction volume and acceptable loss.
- Retain protected copies outside the primary account and infrastructure boundary.
- Encrypt sensitive backups and tightly control download rights.
- Monitor failures and storage capacity.
- Define retention and secure deletion.
- Perform scheduled isolated restores and record time, completeness and defects.
Defend forms, uploads and transactions
Use a payment architecture that limits sensitive payment information handled directly by WordPress. Test declines, duplicate callbacks, refunds and interrupted sessions as well as successful purchases.
Security controls should remain usable. Rate limits and challenges must be evaluated against genuine mobile customers, assistive technology and shared corporate networks.
- Catalogue forms, search inputs, comments, account functions, uploads, APIs and webhooks.
- Validate untrusted input server-side and safely handle displayed output.
- Restrict file types, sizes, storage locations and access.
- Protect login, reset, checkout, email and expensive application functions from automated abuse.
- Authenticate inbound connections and prevent replay or duplicate processing.
- Store integration secrets outside visible front-end configuration.
- Alert an accountable team when form, payment or CRM delivery fails.
Apply POPIA throughout the data flow
The Information Regulator identifies POPIA as South Africa’s personal-information protection legislation. Website controls should support appropriate processing, transparency, minimisation, security, retention, operator governance and data-subject handling with qualified legal and privacy input.
Do not assume a consent banner governs every downstream use. Configuration, server-side connections and operational exports must match the approved purpose.
- Map personal information from the browser into WordPress, email, CRM, payment, analytics and service tools.
- Remove unnecessary fields and trackers.
- Restrict administrative views and exports.
- Define retention for forms, accounts, logs and backups.
- Use sanitised records for development and testing.
- Review operator access, contracts and incident responsibilities.
- Keep published notices aligned with current collection and follow-up.
Harden ecommerce and account journeys
OWASP places broken access control first in its 2025 awareness list. Hiding a button is not access control; the server must verify permission whenever protected information or action is requested.
Test business logic with the operating team. A technically valid sequence can still permit abuse when promotional and fulfilment rules interact unexpectedly.
- Require secure authentication and recovery for customer accounts.
- Prevent users from accessing another user’s orders, files or profile through changed identifiers.
- Recheck authorisation for every sensitive action on the server.
- Protect price, discount, delivery and inventory logic from client-side manipulation.
- Review administrator refunds, exports and role changes through audit evidence.
- Set transaction and fraud escalation thresholds appropriate to operations.
Monitor with a response attached
Build baselines for traffic, forms, orders and error rates. A large deviation can indicate attack or functional failure. Commercial monitoring matters: an available site with a broken enquiry connector is still failing its purpose.
Retain logs long enough for legitimate investigation without collecting unnecessary personal information indefinitely. Synchronise clocks so events across providers can be reconstructed.
- Observe availability, certificates, errors, resource saturation, login failures and administrative changes.
- Detect unexpected modification to critical files, plugins and configuration.
- Review backup status and scheduled-job health.
- Protect important logs from tampering and limit access.
- Route alerts by severity with a primary and alternate responder.
- Test that notifications arrive and escalation works.
Prepare for containment, investigation and recovery
Keep the runbook accessible outside affected systems. Rehearse an account takeover, payment disruption or failed restore. Exercises reveal unavailable contacts and unclear authority much more cheaply than real incidents.
- Define incident categories and severity before an emergency.
- Maintain current contacts for technology, executives, privacy, legal, communications, insurers and key suppliers.
- Give an incident lead authority to contain affected services.
- Preserve relevant evidence and record decisions.
- Revoke suspect sessions, accounts and integrations.
- Establish the entry route and persistence before returning to service.
- Restore from a verified state and monitor closely afterward.
- Evaluate notification duties and customer communication with qualified advisers.
Protect availability and conversion
Document alternate customer routes when forms, checkout or accounts are unavailable. A status message should explain the impact and safe next step without revealing details that worsen risk.
After security updates, firewall changes or recovery, test the entire commercial journey: campaign landing page, content, form, payment, confirmation, email, CRM or order queue and human follow-up. Compare conversion and error rates to baseline.
Publish recognised communication channels so customers can distinguish genuine support from impersonators. Train staff not to request passwords or payment credentials through messages.
Schedule independent assurance where risk warrants it
Routine automated scanning can identify known exposure, but it cannot fully assess permissions, custom code and business logic. Commission risk-based security review or penetration testing after significant changes and for higher-impact applications.
Provide authorised scope, testing window, contacts and safe-handling requirements. Remediate findings according to exploitability, exposure and impact, then verify closure. A long unprioritised report does not reduce risk.
Review suppliers and controls after mergers, agency changes, new payment methods, major plugins or new personal-data uses. Security is changed by business decisions as much as by technical releases.
Turn checklist items into owned evidence
Nelium can assess your WordPress and Elementor supply chain, access, infrastructure, recovery, POPIA data flows, monitoring, incident readiness and customer continuity. Book a website security controls assessment for a prioritised action register.
Email: business@neliumsystems.com
Questions & Answers
Frequently asked questions
Does managed hosting secure everything?
No. It may cover infrastructure controls, while the organisation and its suppliers remain responsible for identities, plugins, custom functionality, data and operations.
Is a completed backup job sufficient evidence?
No. Restore the required data and functions in isolation, measure the result and correct defects.
Should inactive plugins remain installed?
Remove software that has no documented recovery need. Installed code still adds inventory and maintenance burden.
How can security support conversion?
Protect customer information and availability, then test controls so legitimate visitors can still complete forms, accounts and purchases reliably.
Got a Project in Mind? Let’s Talk.
You’ve got a vision — we’ve got the team to bring it to life. Let’s discuss your goals and turn them into powerful results.
Phone: +254 710 520 510
Email: hello@neliumsystems.com
