Cyber Security Action Month 2026: Website Checklist

Why this topic is timely in October 2026

The 2026 campaign is aimed at individuals, SMEs, larger organisations and government. The ACSC says cyber threats are increasing in scale, speed and sophistication and that awareness must become year-round action.

That timing matters for websites because responsibility is usually fragmented. Marketing owns the CMS. A managed host controls infrastructure. An agency deploys code. Finance controls the payment account. A former employee may still own a plugin licence or DNS login. Each individual system can look acceptable while the connections between them remain unowned.

Cyber Security Action Month is a useful trigger for one joined-up review. Ask one business question: could we prevent, detect, contain and recover from a website incident with the people and access we have today? If the answer depends on an absent contractor, an unknown login or an untested backup, the business has found a concrete priority.

1. Map the website estate and assign ownership

Start with the systems that can affect availability, content, customer data or reputation. The list usually includes the domain registrar, DNS, CDN or web application firewall, hosting, operating system, runtime, database, CMS, code repository, deployment service, analytics, forms, email delivery, CRM, payments, search and backup service.

For each system, record the business owner, technical owner, support provider, renewal date, privileged accounts, data handled, dependencies and recovery contact. Add a clear escalation route for incidents outside business hours. If a supplier manages a service, confirm what the contract actually covers: patching, monitoring, backups, restoration, incident investigation and customer communication are different responsibilities.

This register is the foundation for every later control. Without it, teams can patch the CMS but miss the unsupported runtime beneath it, or secure hosting while leaving the domain registrar account exposed.

3. Put MFA around every route that can change the website

The ACSC calls multi-factor authentication one of the most effective ways to protect valuable accounts and information. For websites, apply it to the CMS and to the less visible control planes that can bypass the CMS entirely.

Your coverage should include hosting, domain registrar, DNS and CDN, source control, deployment, cloud administration, database tools, backup consoles, payment administration, analytics, email delivery and vendor support portals. Prefer phishing-resistant options such as passkeys or hardware security keys where the service supports them, particularly for domain, cloud and source-control administrators.

Then review account hygiene. Remove former staff and agencies, replace shared administrator accounts with named identities, reduce standing privileges, store emergency access securely and test the recovery process for lost factors. A strong MFA policy is not complete if the only recovery email belongs to a former employee.

5. Keep logs that answer business questions

The ACSC says centralised event logging improves visibility and supports faster threat detection and incident response. The useful question for an SME is not how many logs it can store. It is whether the available evidence can explain what changed, who did it, what data or services were affected and whether the problem is still active.

Prioritise records for administrator sign-ins, failed access, permission changes, CMS publishing, plugin or package changes, deployments, WAF decisions, server and application errors, form abuse, API authentication failures, payment or CRM delivery failures and backup results.

Send important alerts somewhere a responsible person will see them. Define who responds, what counts as urgent and what the first checks are. Retention should be long enough to investigate incidents that are not discovered immediately, and access to the logs should be restricted so an attacker cannot quietly erase the evidence.

Monitoring also needs a business layer. A website returning HTTP 200 can still be failing if enquiries no longer reach the CRM, checkout callbacks are rejected or confirmation emails stop sending.

7. Buy and build for secure operation

Secure by Design means considering cyber threats throughout design, development, deployment and operation. Secure by Default means a product starts from a useful security baseline, with protections such as MFA, auditing and event logging available without extensive extra configuration.

Use those principles when selecting a CMS, host, ecommerce platform, plugin or support provider. Ask whether security updates are included, how quickly critical patches are applied, whether MFA and audit trails cost extra, how backups are isolated, how incidents are reported, what happens at end of support and how the business can export its data and configuration.

Apply the same standard to custom development. Require peer review, dependency scanning, secret management, separate environments, regression tests, staged deployment and rollback. Keep production changes attributable to a person or automated release. Avoid editing live code through a hosting file manager unless it is a controlled emergency procedure.

A 30-day action plan for an Australian SME

Week 1: Establish control

Name the website owner and technical owner. Build the system and supplier register. Confirm access to the domain, DNS, hosting, CMS, source code, deployment, backups and critical integrations.

Week 2: Close immediate gaps

Remove stale accounts, enable MFA, rotate exposed or ownerless secrets, apply high-priority security updates and identify unsupported components. Document any upgrade exception with an owner and deadline.

Week 3: Prove detection and recovery

Centralise the most useful logs, route alerts to a responsible person and run a backup restore into a separate environment. Test a real enquiry, transaction or booking from the website through to the receiving business system.

Week 4: Exercise the response

Run a tabletop incident, update provider contacts and communication roles, fix the most serious exercise findings and create a recurring quarterly review. Security work becomes sustainable when it has named owners, evidence and dates—not when it depends on someone remembering.