Hosting
- Who is the hosting account in the name of? Ideally your business, with your designer as a user. If it's bundled in a monthly plan, know who the provider is and what happens if you leave.
- Where is it hosted and does that matter for your data? If your site stores customer data, the hosting location may matter for privacy rules where you operate.
- What's included? Email, staging sites, backups, CDN, support hours.
- What are the limits? Storage, bandwidth, form submissions, email sending.
- Who gets alerted if it goes down?
SSL / HTTPS
HTTPS encrypts traffic between visitors and your site and avoids "Not secure" browser warnings. Certificates expire and must be renewed — most hosts now do this automatically. Let's Encrypt explains how it works for free certificates.
Ask:
- Is HTTPS enabled for every version of the domain (with and without www)?
- Does http:// redirect to https://?
- Is certificate renewal automatic, and who is alerted if it fails?
- Do forms and embedded content load over HTTPS (no mixed-content warnings)?
Backups
Backups are only useful if they can be restored. Ask:
- What is backed up? Files, database, form submissions, email?
- How often? And how many past copies are kept?
- Where? Backups stored on the same server as the site can be lost with it. Prefer a separate location.
- Who can restore, and how long does it take?
- When was a restore last tested?
US guidance such as CISA's Cyber Essentials and its ransomware resources stress keeping backups separate and testing them.
Access and security
- Multi-factor authentication on hosting, domain and CMS accounts.
- Individual logins for each person, not shared passwords.
- A record of who has access, kept up to date.
- Software and plugins updated regularly (for CMS sites).
The NIST small business cybersecurity corner has more plain-language guidance.
Who is responsible for what
Write down, for your site:
| Area | Responsible | Contact |
|---|---|---|
| Hosting account | ||
| Domain and DNS | ||
| SSL renewal | ||
| Backups and restores | ||
| Software updates | ||
| Monitoring and alerts |
If a cell is empty, that's the gap to fix before launch.
On MendRev sites
MendRev's monthly website plans include hosting and SSL, and Website Maintenance covers monitoring, a monthly form test and backups. See what a care plan should include for the full comparison.
Questions
Is free SSL good enough?
For most small business websites, yes. Free certificates from authorities like Let's Encrypt provide the same encryption as paid ones. Paid certificates are sometimes chosen for other reasons, but encryption strength isn't usually one.
How often should backups run?
Often enough that losing everything since the last backup would be acceptable. For a site that changes rarely, weekly may be fine; for sites with forms storing data or frequent updates, more often.
Sources and further reading
- Let's Encrypt explains how it works letsencrypt.org
- Cyber Essentials cisa.gov
- ransomware resources cisa.gov
- small business cybersecurity corner nist.gov
Official documentation changes. Check the current version before you rely on a rule, limit or setting.
Next step
See a site built around your real details.
Look at sample layouts (fictional previews, not client work), read published website pricing, or ask for a free concept preview.
Already happy with your site? Website Maintenance covers monitoring, a monthly form test, backups and edits.