CMS Security and Maintenance Basics

The short answer: keep the software on a supported version, apply updates on a set routine, keep a backup away from your host and test that it restores, give every person their own login with the lowest role they need, and remove add-ons you do not use. On a hosted platform most of that is done for you, except logins, app access and your own copies of content. The sections below turn that into a monthly routine.

What the platform does and what you do

On a hosted platform such as Shopify, Squarespace, Wix or Webflow, the company patches the servers and the software. Your share of security is smaller but real: strong logins, careful use of third-party apps and keeping your own copies of important content.

On self-hosted software such as WordPress, Drupal or Joomla, the whole stack is your responsibility, or your host's if you pay for managed hosting. That means the server, the CMS core, every theme and plugin or module, and the database behind them.

Keep software on a supported version

Running software that no longer receives security fixes leaves a site open to problems nobody will patch. Projects publish their schedules:

• Drupal.org lists Drupal 7 support as ended on January 5, 2025, and says Drupal 10 "will reach end of life on December 9, 2026."
• Joomla's documentation lists Joomla 4's end of life as October 17, 2025, and its release policy plans a new major version every two years.
• WordPress.org recommends PHP 8.3 or newer and warns that the older PHP versions WordPress still runs on, such as 7.4, are past end of life. WooCommerce 10.8 and later lists PHP 8.3 or newer among its minimum requirements. Server software has its own end-of-support dates, so check what your host runs.

Put the next end-of-life date for your software in your calendar six months ahead, so the upgrade is planned rather than rushed.

Apply updates on a routine

For a small self-hosted site, a monthly routine is a sensible starting point, with security releases applied as soon as they are announced. Drupal.org, for example, publishes public service announcements ahead of critical core releases so site owners can be ready.

A safe update routine:

1. Take a fresh backup of files and database before anything changes.
2. Update on a staging copy first if your host offers one, and click through key pages.
3. Apply core updates, then themes, then plugins or modules, one group at a time.
4. Test what earns money: contact forms, checkout, booking widgets, logins.
5. Note what changed in a simple log, so you can trace a problem back to its cause.

Back up, and test the backup

A backup you have never restored is a hope, not a plan. Keep at least one copy away from your host, so a problem with the hosting account does not take the backup with it. Restore a backup to a test location twice a year to prove it works. Hosted platforms back up their own systems, but that backup is not a file you can take elsewhere, which is one more reason to keep master copies of your content.

Control who can log in

• Give each person their own account; never share one login.
• Use the lowest role that lets someone do their job. An article writer does not need administrator rights.
• Turn on two-factor authentication wherever the platform offers it.
• Remove accounts the day someone leaves, including agencies and freelancers once a project ends.
• Use a password manager so every account has a long, unique password.

Be choosy about add-ons

Every plugin, module, extension or app is code written by someone else, with access to your site. Before installing one, check when it was last updated, whether it supports your current version and whether you really need it. Remove add-ons you no longer use rather than leaving them deactivated. On hosted platforms, review which apps have access to your store or customer data once a year.

Watch for problems

Simple monitoring catches trouble early: an uptime checker that emails you if the site goes down, Google Search Console for crawl errors and security notices, and a look at the site on your phone after each update. On self-hosted software, a security plugin or your host's scanning service can flag modified files.

Maintenance on hosted platforms

A hosted platform removes server and software updates from your list, but not everything. On Wix, Squarespace, Webflow or Shopify, the recurring jobs look like this:

• Review who has access. Check for logins given to staff, freelancers or agencies during a project and not removed afterward.
• Review connected apps. Each app may be able to read customer or order data; remove those you no longer use.
• Check billing. App subscriptions renew quietly; a quarterly look at what you pay for is worth the time.
• Keep your own copies. Export what the platform allows, such as product lists or collection data, and store it outside the platform.
• Watch the platform's announcements for changes to plans, features or prices that affect your site.

What to do when something goes wrong

Even with good habits, sites break or get compromised. A calm order of work helps:

1. Write down what you see and when it started, with screenshots.
2. Change passwords for the site's administrator accounts, hosting and email, starting with any account you suspect.
3. Contact your host or platform support. On a hosted platform, support may be able to fix the problem for you.
4. Restore from a clean backup on self-hosted software, if the problem started after a known change.
5. Apply any pending updates once the site is stable, since an outdated plugin or module can be the way in.
6. Note what happened and why, and add a step to your routine so it does not happen again.

Keep the phone numbers or support links for your host, your domain registrar and your email provider somewhere you can reach even if the website and email are down.

A yearly review

Once a year, step back from the monthly routine and ask: is the software still on a supported version, and when does that support end? Are all paid apps and plugins still needed? Does the backup restore? Who has access, and should they? Are the hosting plan and platform plan still the right size? An hour on these questions each year keeps small problems from growing.

Who should do the work

Maintenance only happens if someone owns it by name. For a small business, there are three workable arrangements:

• The owner or a staff member, following a written routine like the checklist below. Cheapest in money, and workable if that person has the time and keeps to it.
• A managed host that applies updates and keeps backups as part of the plan. A higher monthly bill in exchange for less work, though you still test your own forms and checkout.
• A developer or agency on a maintenance agreement. Useful for complex sites; ask exactly what is included, how fast security releases are applied and what counts as extra work.

Whichever you choose, write down who is responsible, where backups are stored and who to call in an emergency, and keep that note somewhere other than the website itself.

A monthly checklist

• Backups ran, and one recent copy is stored away from the host.
• Core, theme and add-on updates applied and tested.
• Forms and checkout tested end to end.
• User accounts reviewed; old ones removed.
• Next end-of-life date for your software noted.
• Search Console checked for errors or security issues.

Thirty minutes a month on that list catches problems while they are still small.

Sources for this page

1. WordPress.org: Requirements. Official source, read November 4, 2026.
2. Drupal.org: Drupal core release schedule. Official source, read November 4, 2026.
3. Drupal.org: Upcoming critical Drupal core release on October 14, 2026 (PSA-2026-10-12). Official source, read November 4, 2026.
4. Joomla documentation: Joomla documentation: list of CMS versions and support dates. Official source, read November 4, 2026.
5. Joomla developer manual: Software Release Cycle. Official source, read November 4, 2026.
6. WooCommerce Documentation: WooCommerce Server Recommendations. Official source, read November 4, 2026.