01 The basic hygiene set
Up-to-date CMS/plugins, strong passwords and 2FA for the admin panel, IP/VPN access restrictions for the backend, a WAF on critical projects, and regular backups with tested restore.
02 Forms and user input
CSRF tokens, server-side validation, HTML sanitization, spam bot protection, login attempt limits.
03 Process
A security checklist for every release, uptime and file-change monitoring, and an incident response plan. Security is part of an agency's service quality.
