Know what is exposed
List every live domain, subdomain, hosting account, administrator, form, plugin and third-party integration. Unknown assets become unmanaged risk.
Protect access and recovery
- Use unique passwords and multi-factor authentication where available.
- Remove accounts that are no longer needed.
- Keep software and dependencies supported and updated.
- Maintain off-site backups and test restoration.
- Review forms, uploads, headers and privileged routes.
Prepare for a real incident
Decide who will contain the issue, preserve evidence, restore service and communicate with affected people. Monitoring without an action path creates alerts, not resilience.
Security reduces risk; it cannot responsibly promise that compromise is impossible.