A marketing site looks harmless but sits on your brand domain, runs third party scripts and collects leads. Before launch, secure the domain and certificates, lock down admin accounts, harden forms, audit every third party script, and set basic headers. Most of it takes under an hour.
Domain and certificates
- Registrar account with multi factor authentication and a shared team mailbox as owner, not one person's address.
- Registrar lock on and auto renew on. Expired domains get taken, and the damage lands on your brand.
- DNS records reviewed. Remove records that point to services you no longer use, since dangling records can allow subdomain takeover.
- Certificates issued and renewing automatically, with an alert if renewal fails. Redirect plain HTTP to HTTPS.
- Email authentication records (SPF, DKIM and DMARC) set up for the domain, so criminals cannot easily send mail that looks like yours.
Admin and content access
- Use single sign on or strong unique passwords with multi factor authentication on the content system.
- Give editors only editor rights. Few people need administrator.
- Remove the default admin user name and any install leftovers.
- Keep the content platform and plugins updated, and delete unused plugins. Outdated plugins are a common way marketing sites get compromised.
- Back up the site and test a restore.
Forms and data
- Validate and limit form input, add bot protection, and send submissions over HTTPS only.
- Decide where leads go and who can see them. A spreadsheet of personal data on a shared drive is a risk.
- Publish a privacy notice that matches what you collect, and honour consent for cookies and tracking where the law requires it.
Third party scripts
Each analytics, chat, tag manager or advertising script runs with full access to the page. List them, remove the ones nobody can justify, and prefer loading from your own domain with version pinning where possible. For forms that handle payments or sensitive data, think carefully about which scripts are allowed to run on that page at all.
Headers and monitoring
Set a strict transport security header, a content security policy you can enforce gradually, and sensible framing and referrer settings. Add uptime monitoring and an alert on unexpected changes to the homepage. Check in a month that nothing drifted.
For the supporting code, dependencies in themes and build tooling should be scanned like any other project. The free scan at gold.safeguard.sh/scan can look at a repository.
Do a last pass as an outsider. Open the site in a private window, view the page source, and look at the network requests. Look for forgotten staging links, test pages, exposed backup files and scripts you do not recognise. Then search for your own domain to see what else is indexed. Ten minutes of this often finds what a formal review misses.
Quick check
Do we need a content security policy for a brochure site?
It is not required, but it limits damage from a bad script or injected code. Start in report only mode to see what it would block.
Who should own the domain?
The company, through a role mailbox and a locked registrar account with at least two trusted admins.
Last reviewed: 19 October 2026.
