The website cyber security landscape is forever changing, with AI and more people with online access it becomes critical we take a security first approach. When we talk about web security, it’s easy to think all the responsibility sits with the hosting provider, but the reality is that it’s a joint effort and a website is only as secure as its weakest component.
Conetix secures our infrastructure, network, and servers with multiple levels of security, and we monitor them constantly, but June and July have reminded us that attackers aren’t targeting hosting providers as much as they’re targeting the applications we build and maintain.
How Website Cyber Security is Changing in Australia
Across Australia and globally, we’ve seen large-scale attacks exploiting not only outdated CMS plugins and vulnerable web applications but legitimate ones that have been bought by malicious actors. Once a website is compromised, attackers often install webshells, steal data, or use that site to host phishing pages and malware.
The Australian Government has been talking about the idea of a “human firewall”, this is a human first approach where people are one of the most important security controls. We usually think of that in terms of spotting phishing emails or using strong passwords. But for developers, being part of the human firewall means writing secure code, reviewing dependencies, patching vulnerabilities quickly, and questioning whether every feature or plugin really needs to be there.
Good security isn’t just about firewalls and web application firewalls. It’s about the decisions people make every day. Every pull request, every package update, every configuration change, every user access is an opportunity to improve, or weaken, your security.
What You Can Do To Improve Your Website Cyber Security
From a hosting perspective, we can provide secure infrastructure, backups, DDoS protection, and monitoring. But if an application is vulnerable, attackers will almost always choose the easiest path in. Technology builds the walls, but people decide how strong they are. As developers, you’re not just building websites, you’re part of the front line of cyber defense.
Here is a basic checklist for you to start improving your website cyber security:
- Keep backups of your site, preferably stored in a different location
Read on Why backups are so important. - Keep your site up to date, this means updating Plugins, WordPress, and PHP
- Regularly review access, make sure people only have the access they need.
Read on different roles in WordPress here: https://wordpress.org/documentation/article/roles-and-capabilities/
Read on different roles in Joomla here: https://guide.joomla.org/user-manual/users/users-access-control
How to add and remove a user from your Conetix account: https://conetix.com.au/support/add-a-user/ - Do not share credentials, if a user needs access create a new user for them
- Do not reuse passwords
- Use secure passwords
- To relieve some stress and mental burden it is recommended you use a password manager which can help you create and store secure passwords
- Utilise security plugins such as WordFence
- Utilise activity tracking plugins
- Block access to subdomains if only yourself and your team need access to them – you can reach out to us and we can discuss the options
- Remove any unused subdomains, as these are often forgotten about and not updated they become a threat to your live site
If you ever have any questions about website updates, and how to ensure you’re keeping yourself secure please reach out to us and we’ll be happy to answer any questions.
Relevant links:
The Web Hosting Wizard. (2021, October 11). Affordable WordPress Hosting with Conetix: Reliable Support. Conetix. https://conetix.com.au/wordpress-hosting/
Butler, T. (2020, September 3). Keeping your WordPress website secure • Conetix. Conetix. https://conetix.com.au/support/keeping-your-wordpress-website-secure/
Conetix. Maintaining staging and development sites. https://conetix.com.au/support/maintaining-staging-and-development-sites/
Conetix. Update plugins via WP Toolkit. https://conetix.com.au/support/update-plugins-via-wp-toolkit/
Conetix. Plesk: View website error logs. https://conetix.com.au/support/plesk-view-website-error-logs/
Roles and Capabilities. (2018, December 1). WordPress.Org Documentation. https://wordpress.org/documentation/article/roles-and-capabilities/
Import, S. I. (2026). Access Control. Joomla Documentation. https://guide.joomla.org/user-manual/users/users-access-control
Australian Cyber Security Centre. (2026). Large-scale exploitation campaign targeting website content management systems (CMS). https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/large-scale-exploitation-campaign-targeting-website-content-management-systems-cms
Home Affairs. (2026). Horizon 2: Expanding our reach (2026–2028). Australian Government. https://www.homeaffairs.gov.au/about-us/our-portfolios/cyber-security/strategy/horizon-2
Infosecurity Magazine. (2026). WordPress plugin supply chain compromise (or use the exact article title shown on the page). https://www.infosecurity-magazine.com/news/wordpress-plugin-supply-chain
