Technology Resources for Your Business

1. Back up the current site before changing files.
2. Confirm the correct domain and document root in your hosting account.
3. Upload the website files and preserve the required folder structure.
4. Check the homepage filename and file permissions.
5. Test pages, images, forms, and mobile layout after publishing.

Important: Never upload passwords, private keys, or configuration files containing secrets into a publicly served directory.

1. Open your site using https://.
2. Check for certificate warnings and mixed-content errors.
3. Confirm automatic renewal is enabled where supported.
4. Update internal links and redirects to use HTTPS.
5. Test forms and embedded content after changes.

• Back up website files, databases, and relevant email or configuration data.
• Keep a copy separate from the hosting account.
• Set a schedule based on the cost of losing recent changes.
• Restrict access to backup files and encrypt sensitive copies.
• Periodically perform a test restore and document the steps.

1. Confirm the domain registration has not expired.
2. Check which nameservers are authoritative.
3. Review recent DNS changes and record values with the provider.
4. Check MX records if email is affected, and A/AAAA or CNAME records for the website.
5. Do not delete or replace records without understanding what uses them.

• Explain the service and intended customer clearly.
• Use clear navigation and a consistent visual identity.
• Make contact details and calls to action easy to find.
• Design for mobile screens, keyboard navigation, and readable contrast.
• Compress images, keep pages focused, and test loading performance.
• Include accurate business details, privacy information, and accessible form labels.

• Review the site on phones, tablets, and desktop.
• Check whether visitors can find services, pricing information, and contact options.
• Look for broken links, stale content, slow pages, and accessibility barriers.
• Check analytics or customer feedback if available.
• Prioritize changes by user impact, risk, effort, and budget.

• Write clear, accurate page titles and headings.
• Give each important page a distinct purpose and helpful content.
• Make pages mobile-friendly and accessible.
• Use descriptive link text and meaningful image alternative text.
• Keep business contact details consistent across trusted listings.
• Measure results over time rather than relying on ranking promises.

• What task is slow, error-prone, or difficult to track?
• Who will use the application, and on which devices?
• Can existing software or a small process change solve the problem?
• What data will be stored, and who should access it?
• Who will maintain, secure, and support the application?

• Prototype: explores the interface or user experience.
• Proof of concept: tests whether a technical idea can work.
• Minimum viable product (MVP): delivers a small but useful set of capabilities for real users.

Define success criteria, test with representative users, and document what the early version does not yet support.

• Functional tests for expected behavior.
• Validation tests for missing, malformed, or unexpected input.
• Permission tests for different user roles.
• Compatibility and accessibility checks.
• Performance and recovery tests appropriate to the application.
• User acceptance testing against agreed requirements.

• Identify the records you need to keep and how they relate.
• Choose suitable fields, data types, keys, and constraints.
• Reduce unnecessary duplication and define ownership of each record.
• Plan for validation, access control, backups, and retention.
• Use a database that fits the application's needs and operating capacity.

• Use unique accounts and least-privilege permissions.
• Use parameterized queries or prepared statements for user-supplied values.
• Encrypt connections and protect credentials in configuration or secret storage.
• Patch the database platform and restrict network exposure.
• Back up data and test restoration.
• Log appropriate security events and limit access to logs.

• Define the recovery point objective (how much recent data you can afford to lose).
• Define the recovery time objective (how long service can be unavailable).
• Choose backup frequency and retention accordingly.
• Keep protected copies separate from production access.
• Test restore procedures, including application connections and data integrity.

• Enable multifactor authentication (MFA), especially for email, hosting, finance, and administrator accounts.
• Use a password manager and unique passwords.
• Install security updates promptly.
• Back up important data and test recovery.
• Limit administrator privileges and remove unused accounts.
• Train staff to recognize phishing and verify unusual payment or credential requests.
• Know whom to contact if something looks wrong.

• Be cautious with unexpected urgency, threats, prizes, or payment changes.
• Check the sender address and destination of links carefully.
• Do not use contact details supplied in a suspicious message to verify it.
• Confirm sensitive requests through a known, separate channel.
• Report suspicious messages using your organization's process.

If credentials may have been exposed, use a trusted device to change them, revoke active sessions where possible, and notify the appropriate support contact.

• Keep the content management system, plugins, themes, frameworks, and server components supported and updated.
• Remove unused extensions and accounts.
• Use MFA for hosting and administrator accounts.
• Use HTTPS, secure cookies, and appropriate access permissions.
• Back up files and databases and test recovery.
• Validate inputs, encode output, and protect administrative interfaces.
• Monitor for unexpected changes and have a response plan.

1. Contact your hosting provider or qualified security support through a verified channel.
2. Protect affected accounts; revoke sessions and rotate credentials from a clean device as appropriate.
3. Preserve relevant logs and record what you observed and when.
4. Restore only from a known-good backup after understanding the likely entry point.
5. Check for unauthorized users, altered files, scheduled tasks, and exposed secrets.
6. Determine whether personal or regulated data may have been affected and follow applicable reporting obligations.

For active ransomware, suspected data theft, or a significant breach, seek qualified incident-response and legal guidance promptly.

• Your business, audience, and desired outcome.
• Examples of websites or tools you like—and what you like about them.
• Required pages, workflows, integrations, and must-have features.
• Existing domains, hosting, software, and data sources.
• Budget range, target date, and who will approve decisions.
• Accessibility, privacy, security, and support requirements.

• Keep domain registration in an account the business controls.
• Know who owns or licenses the design, code, fonts, photos, and other assets.
• Document hosting, renewal dates, subscriptions, and recurring fees.
• Use named accounts and secure credential sharing—not a single shared password.
• Agree on source files, backups, documentation, support, and transition assistance.

Ownership and licensing depend on contracts and third-party terms; put expectations in writing before work begins.

• Existing software: often faster to start, with established features and vendor support, but may require compromises or recurring fees.
• Custom development: can fit a unique workflow, but requires requirements work, testing, maintenance, security updates, and ongoing ownership.
• Compare integration, data export, accessibility, privacy, reliability, support, and exit options.
• Consider a small prototype or process improvement before committing to a large build.

• Ask your email provider which SPF, DKIM, and DMARC records are required.
• Publish records carefully at the authoritative DNS provider.
• Make sure only one SPF record exists for the domain and that it includes the services you actually use.
• Test changes and review bounce messages before making additional changes.
• Do not copy DNS values from an unrelated domain or provider.

• Use meaningful headings in a logical order.
• Provide descriptive alternative text for informative images.
• Make links, menus, and forms usable with a keyboard.
• Use readable text and sufficient contrast.
• Label form fields and provide clear error messages.
• Test with zoom and at least one keyboard-only pass.

1. Test more than one page and device.
2. Compress oversized images and use appropriate image dimensions.
3. Review third-party widgets and scripts.
4. Check server response time and hosting resource usage.
5. Use a performance test to identify the largest bottlenecks.
6. Retest after each significant change.

• Use a unique password for every important account.
• Enable multifactor authentication where available.
• Share business credentials through approved secure sharing features, not email or text.
• Remove access promptly when a worker or vendor no longer needs it.
• Keep recovery methods current and stored securely.

• Change default administrator credentials.
• Use WPA3 or WPA2-AES where supported; avoid obsolete security modes.
• Update router firmware and disable remote administration unless it is required and securely configured.
• Use a separate guest network for visitors.
• Document who manages the equipment and how it can be recovered if settings are lost.

• Assign responsibility for updates, bug reports, and user questions.
• Keep a record of dependencies and supported versions.
• Monitor errors and service availability appropriately.
• Back up data and test recovery.
• Document configuration, integrations, and deployment steps.
• Review access and remove unused accounts.

• Identify what data is collected and why it is needed.
• Determine legal, regulatory, contractual, and operational retention requirements.
• Keep only information needed for a legitimate purpose.
• Restrict access and protect retained records.
• Define secure deletion or de-identification procedures.
• Ask qualified legal or compliance counsel when requirements are uncertain.

• Critical systems, services, vendors, and business contacts.
• Backup locations, access procedures, and restore instructions.
• Recovery priorities and acceptable downtime or data loss.
• Alternate ways to communicate and serve customers.
• Roles, escalation steps, and incident documentation.
• A schedule for testing and updating the plan.