What website security responsibilities remain with the owner?

Understand the three responsibilities

Website security is shared, but shared does not mean undefined. The owner decides what the website must protect, which risks matter to the business and what budget or service level is acceptable. The provider operates a platform, hosting environment or tool and should secure the parts it controls. Users follow safe access practices and report problems.

Write these responsibilities down in plain language. A provider may protect the underlying server while the owner still has to update plugins, remove old accounts, approve integrations and decide how long customer data is kept. If no one is named for a task, assume it may be missed during a busy period or after a staff change.

Use a simple responsibility table with three columns: owner, provider and user. Include the account or system, the action, the frequency and the evidence that it was completed. This makes vague promises easier to test and easier to hand over.

What the owner must decide

The owner is responsible for choosing trustworthy providers, understanding the service agreement and making sure important accounts have business-controlled ownership. The owner should know which domain, hosting, email, website, analytics and third-party accounts exist. They also decide who gets access and what happens when a supplier or employee leaves.

Owners must set priorities for backups, updates, monitoring, privacy and recovery. They do not need to perform every technical action, but they need enough visibility to ask whether the work is happening. A monthly report, maintenance log or short review meeting can expose expired software, failed backups and forgotten administrator accounts.

Ownership also includes continuity. Store recovery information in a business-controlled location and make sure more than one responsible person can reach it. A security task that depends on one private inbox is not resilient.

What the provider should manage

The provider’s responsibility depends on the service. A hosting company may manage server patches, network controls, platform availability and infrastructure backups. A website agency may manage updates, code, monitoring and content changes if those tasks are included. A SaaS provider may secure its application while the customer remains responsible for accounts, settings and data entered into it.

Read the agreement and ask specific questions. What is backed up, how often and for how long? Who applies security updates? How are vulnerabilities reported? Who can access production? What happens after cancellation? A provider’s claim that a service is secure does not automatically cover custom code, weak passwords or unsafe settings controlled by the owner.

Ask for evidence rather than accepting a general statement that the platform is secure. A maintenance log, update record or incident process shows what the provider actually does and where the owner still needs to act.

What users must do

Users protect the accounts they use. They should use unique passwords, a password manager and multi-factor authentication where available. They should avoid sharing accounts, approve only expected login prompts and verify unusual requests through a known channel. Users also need a simple way to report suspicious messages, lost devices and accidental disclosures.

Access should match the role. A person who edits content may not need administrator rights, payment access or database access. Review permissions when responsibilities change and remove access promptly when someone leaves. Good security is easier when the normal workflow makes the safe action clear instead of relying on memory.

Users need clear boundaries about what they may change. A short approval process for integrations and permissions prevents well-intentioned changes from creating an access path nobody reviews.

Protect data and integrations

List what the website collects and where the information goes. Forms may send names, phone numbers and messages to email, a CRM, a booking tool or a spreadsheet. Payment, analytics, chat and marketing integrations can create additional accounts and data paths. The owner must know why each integration exists and whether it is still needed.

Limit data, check supplier settings and keep privacy notices accurate. Do not assume that a provider’s security removes the owner’s responsibilities for lawful use, access control or retention. Remove unused integrations and rotate keys when staff or suppliers change. A smaller, documented system is easier to protect than a collection of forgotten connections.

Privacy and security decisions should be connected. Collecting less data reduces the impact of an incident, while accurate notices and retention rules help the team respond consistently when a customer asks about their information.

Review and respond as a business

Security is not finished when a certificate is installed. Review accounts, software, backups, logs, domains, integrations and recovery routes on a planned schedule. Record what was checked, what changed and who owns the next action. Test restoration and incident contacts before an outage makes every decision urgent.

When something goes wrong, preserve evidence, contain access and contact the relevant provider. Tell affected people what they need to do without making unsupported claims. Afterward, improve the process rather than only replacing a password. Clear ownership turns security from an assumption into a practical operating habit.

Practice the first hour of an incident: who calls the provider, who disables access, who checks backups and who communicates. Preparation reduces panic and prevents several people from making conflicting changes.

Sources

• Cybersecurity Basics · CISA
• Cybersecurity guide for SMEs: 12 steps to securing your business · ENISA

Frequently asked

Is the website provider responsible for all security?

No. Providers secure the parts of the service they control. Owners remain responsible for accounts, settings, content, data, integrations and decisions included in their own workflow.

Does an SSL certificate make a website secure?

No. It encrypts connections but does not protect against weak passwords, outdated software, unsafe permissions or compromised integrations.

What should an owner review first?

Start with ownership and access: list accounts, administrators, providers, integrations and recovery methods. Then check updates, backups, data handling and incident contacts.