Insights — Defensive Cybersecurity
What a security baseline actually covers (and what it doesn't)
“Is my website secure?” is not a yes/no question. A security baseline is a defined set of basic, high-value checks — the digital equivalent of confirming the doors lock, the alarm works, and someone has a spare key. Here is what it normally includes, and — just as important — what it never includes.
What a baseline covers
- Software currency: CMS, plugins, and server components updated, with abandoned components flagged.
- Access control: who can log in, whether old accounts still exist, and whether admin paths are unnecessarily exposed.
- Authentication basics: strong unique passwords and two-factor authentication for admin accounts.
- Transport security: HTTPS properly configured, with no mixed-content warnings.
- Backups: whether they exist, where they live, and — the part everyone skips — whether a restore has ever been tested.
- Configuration hygiene: error display, directory listing, default settings, and exposed files tidied up.
What it doesn't cover
- It is not a penetration test. Nobody is simulating a determined attacker, chaining vulnerabilities, or testing your team's responses.
- It is not monitoring. A baseline is a snapshot on a date, not a guard on duty. If someone offers you “complete protection” from a one-time review, they are selling you a feeling, not a control.
- It is not a guarantee. It reduces the most common, most automated risks. Determined, targeted attacks are a different problem class with different (and much more expensive) answers.
The five things you can do this week, free
Turn on 2FA
Every admin account, every platform. This single step blocks the most common account-takeover path.
Update everything
CMS, plugins, themes. Then delete what you don't use — unused plugins are attack surface with zero benefit.
Audit the accounts
Remove ex-staff and test accounts. Rename nothing, share nothing: one person, one account.
Test one restore
Restore last week's backup into a test space. A backup that has never been restored is a hope, not a backup.
Write down who owns what
Domain registrar, hosting, DNS, admin emails. If the answer is “an ex-employee's personal account”, fix that first.
Our defensive cybersecurity service performs exactly this kind of baseline work — on systems you own, under written authorisation, with findings reported honestly including their limitations.
Have a project in mind?
Tell us what you are trying to build or fix. We reply with honest next steps — including if we are not the right fit.