A maintenance starting point; security controls should match the application's actual functions.
Protect connections and administration
Use a valid TLS certificate for the domain and check that the site serves its intended content through HTTPS. OWASP's TLS guidance explains transport protection and certificate considerations. Protect hosting and administrator accounts with strong unique credentials and multi-factor authentication where available. Remove access that is no longer needed.
Reduce unnecessary components
Keep the operating system, server, CMS, themes, and plugins maintained where they are used. A static site may have fewer application components, but its hosting account still requires protection. Avoid leaving installation archives, credentials, private notes, or unnecessary management tools in the public web directory.
Verify changes and plan recovery
After a deployment, test the homepage, a deeper URL, the error page, and important assets. Keep a known working copy of the site's files and relevant configuration so a failed change can be reversed. Review unusual redirects and unexpected file changes promptly. Test one change at a time when diagnosing a problem, recording what changed and how it was checked.
GO TO THE SOURCE
Read further.
Sources were reviewed for this edition. Follow the original publisher for later changes, event details, or product information.