How to Make a Website Secure, in Our Opinion

Sure your website is secure? Truly secure, as the regulations require.

Because, in reality, website security is a sore point in our country. Consider that, until just a few years ago, only 47% of Public Administration websites could be considered secure.

And if that’s the case in the public sector, just imagine the private sector.

But we’re not here to scold you. We’re here to lend a hand. In short, to explain how to make your website secure and protect your data, as well as the data of the people who visit it.

And no, this isn’t just for big companies.

Trust us.

Website Security Is a Matter of Strategy

Non-experts often believe that website security just requires a one-time fix. So let’s start here. Let’s start by busting the first myth.

Security is a strategy. Ongoing, updated, well thought out. The “I’ll deal with it when something happens” approach doesn’t work with a website, especially if you rely on that website for work.

In short: if you have a small personal space — a blog, for example — then maybe you can take it lightly. In that case, even a plugin might be enough (but please don’t tell our security team; don’t tell them we said that!).

But if you rely on your website for work — say it’s an e-commerce site you’ve invested a substantial budget in — security is not something you can take lightly.

So if you’ve been managing the website on your own so far, or you’ve relied on someone who never explained anything to you, you’re probably moving around ‘unprotected’.

So remember this: making a website secure means making decisions before something happens, not after. It means knowing what you’ve installed, why, and who has access to it.

This alone is already a great starting point.

Privacy by Design: A Secure Website from the Ground Up

There’s a principle that comes directly from the GDPR and that many happily ignore: it’s called privacy by design. The GDPR regulation addresses it in Art. 25, whose title is precisely: “Data protection by design and by default“.

In very simple words, it means that data protection isn’t added at the end, as an afterthought. It’s designed from the start, within the site’s architecture. Before the site goes live. Before the first user fills out the first form.

You’ll need, then, to ask yourself some uncomfortable questions.

Such as:

1. What data am I collecting?
2. And if I’m collecting them, do I really need them?
3. Do I need to keep them for this long?
4. How many users can access them?
5. Is that number sufficient, or too high?

In short, it’s about deciding upfront what type of data to collect — keeping in mind, rightly, that you should collect only the bare minimum, store it as securely as possible, and delete it once it’s no longer needed.

Even permissions and access levels need to be regulated, as Art. 25 states, “by default,” already at the stage when you design the website. Everyone should be able to see only what they need to see.

This is how you ensure a website’s security.

Or at least a small part of it.

Data Encryption Turns Your Website into a Fortress

When a user fills out a form on your website (whether to contact you, buy something, or sign up for the newsletter), that data travels. And if it travels unencrypted, anyone can intercept it.

The SSL certificate and the HTTPS protocol exist for exactly this purpose: to encrypt the communication between the user’s browser and your server. This way, the data becomes unreadable to anyone who isn’t the intended recipient.

Today, an HTTPS website is the bare minimum. Google even considers it a ranking factor — so much so that this is also checked during an SEO audit. You’ll have noticed, for example, that your browser warns you when you enter a site that doesn’t use this protocol.

So, a site running on HTTP (without the S!) is a slip-up you can’t afford. That said, it’s obvious: needless to say, it’s not enough on its own. Encryption protects data while it’s in transit.

For everything that happens afterward (who accesses your database, how backups are stored, who can download files from the server), other measures are needed. We’ll cover this too.

Web Application Firewall Against DoS Attacks

Every day, thousands of bots roam the web looking for vulnerable websites. They’re not specifically targeting your site, of course. But they are looking for anyone with an open door. And when they find one, they get in.

The most common attacks have technical names (SQL injection, cross-site scripting, brute force), but they all work on the same logic: they look for a weak point and exploit it. DoS and DDoS attacks, on the other hand, do something different: they flood the site with requests until it goes offline.

A Web Application Firewall (WAF) intercepts all of this before it reaches its destination. It analyzes every request, recognizes suspicious patterns, and blocks whatever shouldn’t get through.

In effect, we’re talking about a filter — or “firewall,” which is literally what the word means. If the WAF is configured correctly, it greatly reduces the risk of going offline.

But watch out! Only if it’s configured correctly. Because a WAF left at its default settings doesn’t do much. Consider this: every website has different plugins, different functions, different traffic.

The Web Application Firewall must therefore be configured according to specific rules that work for your site, and no one else’s.

Two-Factor Authentication That Prevents Intrusions

How many people have access to your website’s admin panel? How many still use weak passwords, the same ones used for other accounts?

A stolen password (e.g., from a data breach, phishing, or even simple carelessness) is all it takes to lose control of your website. And getting it back is never quick or painless.

Two-factor authentication (2FA) thus adds a second layer of verification. This way, even if someone has your password or a partner’s password, they still won’t be able to get in without the second code.

It’s a simple measure, free or nearly so, and incredibly effective. So, in short: turn it on! For all users with backend access, no exceptions. And while you’re at it, review who has access to what: you’ll often find forgotten accounts, former collaborators still enabled, and permissions higher than necessary.

A Secure Website Is a Competitive Advantage

Trust us when we tell you that website security is also a matter of reputation. So it goes without saying: making a website secure is not optional. And if you haven’t done it yet, you should start thinking about it right away.

Think about it:

• a hacked website loses users’ trust
• Google penalizes it or blacklists it
• customers who find out they weren’t safe don’t come back

Aren’t these scenarios to avoid? Trustworthiness, in the digital world and beyond, always translates into conversions. In short, into sales — or bookings, or commissions, etc.

If you have doubts about your website, we recommend the free analysis from No Digital Brain. A test carried out by our in-house team that tells you whether your site is secure, of course, but also what can be done to improve its performance.

You’ll receive a detailed report within 48 hours directly in your email, along with tips and suggestions that will be very useful should you want to fix the issues on your own.