Start with the accounts that can change your site, domain and hosting. Remove access for people who no longer need it, issue individual logins and turn on multifactor authentication where available. Make sure a trusted staff member can recover each business-owned account.
Pair website updates with a test
Review what is changing and confirm you have a recent backup. After the update, check that customers can still reach the site and complete key tasks. Keep a short record of what changed and who checked it. That helps narrow things down if a page starts behaving differently.
Agree on who gets called first
Keep a contact list outside the website. Include hosting support and the person who can approve recovery work. Have a separate copy of the backup and recovery plan so you can get to it even when the site is down.
Make the first response easy to find
Suppose your website redirects customers somewhere unfamiliar on a Saturday. Staff need a contact they can reach and simple instructions for recording what happened. Keep a copy of the hosting and maintenance contacts outside the site. Include who can approve recovery work and where the last tested backup was recorded.
- Review who can edit, publish, pay for, or recover key accounts. Remove access that is no longer needed.
- Check that maintenance includes a backup and a customer-task test after changes.
- Record the URL, time, and symptoms if something looks wrong. Avoid sharing customer records in screenshots.
During an incident, gather enough detail for the person who will investigate it. If a shop reports “the site is broken,” ask which link they clicked and what they saw, then pass that to the appropriate provider. Once the site is stable, check the paths customers use and review access with whoever handled the fix. A record of what changed makes the next review quicker.