Website security starts with everyday ownership
Your website, email and cloud accounts may have different administrators. When something goes wrong, establish who is responsible, which services are affected and what information needs preserving. This guide draws on Queensland Law Society (QLS) cybersecurity resources and adds practical website-management suggestions for Hong Kong businesses and organisations.
This is an independent HK Web Rescue summary, not an official QLS translation or endorsement. QLS materials address Australian legal practice; their member assistance, insurance arrangements and legal requirements should not be assumed to apply in Hong Kong.
Suspect an incident? Contain the impact and arrange help
- Isolate suspect devices: disconnect a potentially infected computer from the network and seek technical help. Avoid signing into important accounts on it.
- Appoint a coordinator: bring your host, technical support and colleagues together through a trusted communication channel.
- Address account and payment risks: use a known-clean device for affected accounts. Contact the bank promptly about suspicious payments and verify payment instructions through an established phone number.
- Assess data exposure: obtain professional help to identify affected information and assess notification and reporting needs.
Reference: QLS cybersecurity first-response checklist.
For website owners: collect the time, affected URLs, screenshots and recent change records. Ask your host to preserve relevant logs. Avoid repeatedly overwriting files or restoring backups before agreeing a response plan.
Protect important accounts with MFA
Enable multi-factor authentication (MFA) for email, website administration and cloud services, alongside strong, unique passwords. Choose an authenticator or security key where supported. MFA still needs phishing awareness: never share one-time codes or approve login requests you did not initiate.
Reference: QLS multi-factor authentication guide. When arranging setup, also document account ownership and the handover process when staff leave.
Make WordPress maintenance verifiable
- Arrange WordPress, plugin and theme updates, using trusted sources.
- Limit administrative access and review who still needs it.
- Back up website files and the database, and check that restoration works.
- Keep logs, monitor unusual activity and clarify responsibilities with your host.
Reference: WordPress official hardening guide.
A useful maintenance record has four columns: task, owner, completion date and follow-up. Check enquiry forms and important pages after updates so the next person taking over can understand the work completed.
Further reading for your situation
The QLS cybersecurity resource centre also covers cloud services, working from home, mobile devices and business identity theft. Check each document’s date, jurisdiction and intended audience. Confirm Hong Kong reporting and compliance needs with an appropriate professional for your circumstances.
Need help understanding a website problem?
Send HK Web Rescue your website URL and a description of the symptoms to request a free initial review. This covers publicly visible information. Deeper investigation and repair require agreed authorisation, scope and pricing. Do not send passwords, verification codes or sensitive client records through the enquiry form.