Installed Platforms

We’ll start with installed platforms because the 400-pound gorilla in the CMS space is Wordpress, and Wordpress is an installed platform. (Wordpress actually offers a hosted version, too. More on that later.)

As the name implies, an installed CMS requires you to install the system code onto a web server that you own, rent, or otherwise control. Once it’s installed, you customize the basic design, layout, and functionality to fit your needs.

The main disadvantage to using an installed CMS is that with all that power comes a lot of responsibility. You are responsible for setting up appropriate hosting for the site and for maintaining the site to keep it safe and secure.

That can be more than you might want to take on and if that’s the case but you need the power and flexibility of an installed CMS, you’ll need to consider the expense of a maintenance plan with a web development firm you trust. This will generally cost more than the monthly fees charged by a hosted CMS solution.

If your marketing depends on the flexibility and power that come with installed CMSes like Wordpress, Drupal, and others, the relatively small additional cost will be well worth it, as will the more significant difference in development costs.

It’s worth noting that an installed CMS isn’t inherently a more expensive way to build a website. Development costs tend to be higher, though, because if you are using an installed CMS, you are almost certainly building a more complex site.

Hosted Platforms

The main alternative to an installed CMS is a hosted web development platform. The advantage here, in addition to the cost savings I just mentioned, is that a lot of the technical headaches and responsibilities that come with owning a website are removed from the equation. Your website is hosted on the platform’s server and they are responsible for all updates and upgrades to keep the hosting environment—and your website—safe, secure, and compatible with new browsers and mobile devices.

The downside is that the tools you have at your disposal will be more limited. That’s not to say that you can’t build a fantastic site on a hosted platform. The tools they typically make available are the more popular options. So you’ll be able to build features into your site like collecting emails directly into Mailchimp, iContact, or other email marketing tools; building forms to allow site visitors to contact you with questions; and displaying content like video, animations, and other content beyond the written word.

Site Portability

One other downside to hosted platforms is that it’s harder to simply pick up your website and take it elsewhere if you aren’t happy with the platform you’re on or if the platform no longer meets your needs.

Some hosted platforms do offer export tools, though there will almost always be a fair amount of work to import your site into a new platform, and not every import platform will be compatible with your exported files.

With installed platforms, there is a much greater chance you can cut ties with your hosting provider or the team who built your site for you. (Or both.)

That’s especially true if the CMS you’re using is open source. Open source means that the source code for the CMS isn’t owned by a for-profit company. In most cases, it isn’t owned by anyone, but is managed by a collective group of volunteers who all work to keep the CMS current. Many of these folks also contribute new features and functionality to the platform.

This might sound like chaos. In fact, many larger corporations do not consider open source tools for that very reason. (“If there’s no one in charge, who can we blame when things go wrong” is a perhaps less-than-charitable assessment of their concerns.)

The truth is more complicated than that, and while there can be issues with this kind of distributed management, in practice we see that the best open source tools are actually more responsive to market needs and changing conditions than for-profit software typically is.

That makes sense when you think that volunteers working to keep a CMS vital and vibrant aren’t as likely to be thinking in terms of profit margins and cost/benefit analysis. They will want to patch a reported security vulnerability as quickly as possible.

I’m simplifying to some extent and the more open nature of an open source platform can lead to conflicts and incompatibility between plugins, widgets, and other add-ons that simply don’t occur in a more unified system. Still, open source tools do power quite a bit of our web infrastructure and some of the leading web CMS platforms are open source, like Wordpress.

The Middle Ground

Although hosted and installed solutions are the two most common, there are a couple of ways that combine elements of both options.

The approach nearest to the middle ground is usually referred to as managed hosting. In this scenario, you get the flexibility and power of a fully customizable CMS like Wordpress, but can hand off the maintenance and management of the installation to the hosting provider. Some of these providers even include a “one-click” installation option to further speed the process and remove some technical hurdles.

You still have to plan, design, and build out the site, but that is true of hosted solutions, too. And once you’ve worked through construction, you are able to maintain site content without much (if any) tech support beyond what the managing hosting provides.

Many website hosting providers offer some version of this, though they don’t all call it the same thing. And each will have its own set of restrictions regarding certain add-ons which they may view as security or performance risks. Typically, these won’t be on your radar anyway.

Another Wordpress option is Wordpress.com, which is their hosted solution. As with managed hosting, here you will have to deal with some restrictions but you are once again in a one-stop shopping situation, where much of the technical maintenance burden is covered by your monthly fee. (The installed version of Wordpress is found at wordpress.org.)

Finally, there are also website-building tools tied to various marketing platforms like Hubspot and Mailchimp which can be worth considering if you are already using one of these tools as your CRM platform. (Customer relationship management.)

The upside is impressively tight integration across a number of digital marketing channels, like email marketing and your website, and a much greater focus on attribution than will typically be found in a more traditional hosted or installed solution.

The downside—and the reason these may not be the best solution for many marketers—is that you are tied in to a proprietary system that can make it costly and painful to switch if your marketing or budget needs change.

Combined with the integration add-ons that are available for just about every CMS, the argument is typically stronger against using proprietary tools.

Making Your CMS Choice

If a proprietary tool feels like the right choice for you, though, it doesn’t matter what the typical marketer might find effective. What matters most is your comfort level and how the platform you select fits in with your marketing needs, marketing resources, and workflow.

You and your team must be absolutely comfortable with the platform you choose—or confident that with some time to acclimate, you will be comfortable—or your marketing effectiveness will suffer.

Any friction that is added to the process of adding and editing content, like needing to rely on an outside vendor, will slow your process and ultimately train you not to take advantage of the most timely marketing opportunities since you know that execution will take too long.

Update Regularly

Wordpress and any plugins you have installed should be updated regularly. The same is true for the “core” code of any other CMS you might be using, and any plugins, widgets, apps, or other add-ons that help power your site.

Before you install any add-on, review it thoroughly to make sure it is safe and secure and regularly updated itself. Add-ons that are poorly maintained by their development teams can be the weakest link in your security chain. Vet them well before installing and you shouldn’t have any issues. Seek out plugins that are well reviewed, regularly maintained, and that have responsive development teams behind them.

Back Up Your Site Regularly

How often will depend on how actively your site content is updated. We typically recommend backing up the site either weekly or daily, and storing at least one month’s worth of backups.

Storing a reasonable library of backups will help ensure that if your site is compromised, you’ll have a clean backup to go back to even if you aren’t immediately aware of an issue.

We also recommend that you back your site up to a file depository off the web server, which guards against losing your site to a catastrophic server failure.

With many hosting providers, this will be redundant, since they are guarding against calamities like this. But if their issues take days or weeks to sort out, you can be without a site for that whole time. With off-server backups at your fingertips, you can quickly and easily restore the site to a different hosting provider, whether permanently or temporarily.

Security Monitoring

Not every attack will be visible to you or your site visitors. Malicious code can be installed into the site and do its dirty work without you ever being able to tell just by visiting the site. (Or even when you log in to make editorial updates.)

Typically, that kind of attack is not aimed at harming you or your site visitor, but it can still have unintended negative consequences. Prime among these is getting your domain blacklisted.

This occurs when search engines and other entities on the web detect that malicious activity is tracing back to your domain. They won’t necessarily have any way of knowing whether your site is a legitimate website or a front for the malicious coding lurking underneath.

Blacklisting can affect your email as well as your website, and once you’re blacklisted it can be very difficult to reverse the process.

To combat this, you should have some form of security monitoring in place that alerts you to potentially negative activity on your site. You can then take action quickly before there is any chance of blacklisting. You will also minimize how far into your backup archive you’ll need to dig to restore a clean copy of the site. The further back you have to go, the more content changes you’ll have to recreate.

Manage Passwords Intelligently

You’re not using “password123” as your password, are you? Or the same password you’ve had in place since 2012? (Which you also use on every other account you log into?) These are no-nos you should avoid.

You can also check to see whether your passwords have been compromised. Various websites exist that perform this service, and many of the popular password managers do, as well.

Two-factor authentication can be annoying, particularly if you are part of a team and that team works remotely and from different locations. It can also help prevent access more completely than passwords alone.

Single-Sign On is another approach that helps with security and controlling access. SSO allows you to control access more conveniently if you have contributors to your site whose access you’d like to control. (Like a vendor who needs login for a few weeks of work once in a while.)

SSO can be expensive for smaller businesses, but some of the better password managers offer a version that while not as feature-rich as a purpose-built tool like Okta, is far more budget-friendly for most small businesses.

A quick word about password strength. Those crazy rules saying you must use an upper case, letter, lower case letter, numerical character, and special character may be just that: crazy. Longer passwords can be tougher to crack, even without the requirements for different characters.

Longer passwords can also be easier to remember if you create phrases rather than single words. The length of “nowisthetimeforallgoodmen” alone—25 characters—makes it hard to crack even though all 25 characters are lower case letters.

Finally, you should consider adding code to your site that limits the number of log-in attempts that can be made before the site is locked as a further protection.

Control Access

With or without an SSO platform in place—which can help you control access to far more than just your website, by the way—you should also be diligent about deleting credentials for anyone who no longer needs access.

Doing this manually isn’t generally too onerous a task, though it can be hard to keep track of exactly what an employee has had access to. You’ll want to delete their access or, for accounts where you have just one log in, change the password. (Accounts like your email marketing account will typically have just one login included.)

This is another area where SSO is useful and can save you time in the long run.

Let’s take a look at some of the more technical ways you can harden your site to keep it safe.

Run Lean

Delete unused themes and plugins and other related files, including any old versions on the server. Even if they’re sitting there alongside your live site “just in case,” they can be exploited in the same way your live site can. (This can also improve site speed and other performance metrics for your site.)

Delete Defaults

Every CMS installation starts its life in exactly the same shape and size as every other installation of that same CMS. From that plain vanilla beginning, you customize the code to fit your needs for design, layout, functionality, and structure.

Despite all of that customization, beneath the surface there are a great many points of vulnerability that remain common to most sites. These defaults include things like the default admin user ID, the directory in which your login page is found, prefixes for databases, and other areas that could provide entry to hackers.

Changing these will protect your site further. For example, whether your passwords are strong or weak, it’s much harder for a bot to guess your password correctly if it is pairing that password with the wrong user ID. So changing “admin” to something like site-name-admin, where you substitute your site’s name for site-admin, makes it far less likely that a bot can use a brute-force attack to enter. (Though it would be wise to be more creative in creating a new admin ID name.)

Again, being creative can help make this tactic more secure, but if you are using a good password manager, you shouldn’t need to memorize or even type in the login URL. Simply open your password manager—the only password you’ll need to remember—and login from there.

Firewall Protection

Many of the security and hardening ideas discussed above are largely non-technical and focus more on the human side of your site. What hackers sometimes refer to as “social engineering.” There are, of course, more technical tools available to protect your site, including firewalls.

A firewall, whether it is hardware-based or software, acts as a gatekeeper, with all traffic to your site first passing through the firewall. The firewall examines the traffic in an instant and blocks any that appear to be malicious. This cuts the chance of a malware or other hacking attack ever reaching your site, so it adds a layer of protection beyond the hardening you’ve put in place.

Hardware firewalls are generally more robust, but also more expensive and complex. Software firewalls are simpler to set up and maintain, and cost less. Which is better for you will depend on the kind of data that your site handles. For highly-sensitive information like financial transactions, you are going to want a higher level of security.

SSL Certificates

It’s almost not worth talking about SSL certificates since they have become so widely used, but it is worth saying that no site, even sites that are purely informational, should be without an SSL certificate.

The certificates help establish who owns and controls the site and most browsers will not display an icon or message when a visitor attempts to view a website not covered by an SSL certificate.

So even if you don’t process sensitive information, you do want to give your visitors the peace of mind that your site is as secure as possible.

File Permissions and Database Security

Another area where defaults can be set to leniently by default on many CMS platforms is file permissions. This definitely gets into more technical territory, so I won’t go into detail, but it’s important for you to check with your development/site management teams that only those files and directories that are absolutely required to be editable are. Everything else should be read-only.

It’s also possible to control access to sensitive directories by IP address. This would preclude anyone who is not accessing the server from a predefined list of IP addresses would not be permitted access.

Similarly, many CMSes have standard prefixes for database files. These should be changed wherever possible to make it harder for hackers to find and compromise them.