FilteDev blog

Website security starts before the first line of code: a practical checklist for business owners

edmond@filtedev.com (Edmond Dema) — Sat, 26 Sep 2026 12:49:22 GMT

Most small business websites are not hacked by someone who chose them as a target. They are found by automated tools that scan the internet around the clock, looking for known weaknesses: an outdated plugin, a reused password, an admin account nobody remembered to remove. Once found, the site is used to send spam, host malware or redirect visitors elsewhere, often without the owner noticing for weeks.

The good news is that most of these problems are preventable, and preventing them is much cheaper than cleaning up afterwards. The catch is that security is hard to add at the end. It depends on decisions made at the start of a project: who owns what, how updates happen, and what gets installed. This checklist covers the questions worth asking before a new website is built, or about the one you already have.

1. Who owns the accounts?

Your domain name, your hosting, your DNS settings and your website platform should all be registered in your business's name, with your email address as the owner. Your developer should have their own login with the access they need, not the master account.

This matters for security as much as for business continuity. If a developer or agency disappears, gets hacked or simply stops replying, you need to be able to change passwords, revoke access and move on without asking anyone's permission.

Ask: "If we stopped working together tomorrow, could I lock you out of everything on my own?" The answer should be yes.

2. How will updates be handled?

Every website runs on software that needs updating: the content management system itself, its plugins or extensions, and the code libraries a custom site depends on. Security fixes are released regularly, and attackers pay close attention to what they fix, because every published fix also tells them which older versions are vulnerable.

A site that was secure on launch day will not stay secure on its own. Someone has to apply updates, check that nothing broke, and do it on a schedule rather than when there is spare time.

Ask: "Who applies updates, how often, and how do you test them before they reach the live site?"

3. What happens if something goes wrong?

Backups are the difference between a bad afternoon and a lost business asset. A useful backup setup has three qualities: it runs automatically, copies are stored somewhere separate from the website itself, and someone has actually tested restoring from them.

That last point is the one most often skipped. A backup that has never been restored is a hope, not a plan.

Ask: "How often is the site backed up, where are the backups kept, and when did you last test a restore?"

4. Who can log in, and how?

Every person who works on your site should have their own account, with only the permissions their role needs. A content editor does not need the ability to install plugins. A freelancer who finished a project last year does not need access at all.

Shared logins make it impossible to know who did what, and impossible to remove one person without disrupting everyone else. Two-factor authentication should be switched on for every account that can change the site, especially administrators.

Ask: "Does everyone have their own login, is two-factor authentication required, and how do we remove people who leave?"

5. How are your forms protected?

Contact and quote forms are often the only part of a business website that accepts information from strangers, which makes them a common target. At a minimum, forms should be protected against spam bots, check the information they receive, and send it over an encrypted connection.

It is also worth knowing where form submissions go. Sending them to a CRM or a secure inbox is fine. Sending sensitive details such as health, financial or identity information through plain email notifications is not, and in some industries it creates legal obligations you may not be meeting.

Ask: "Where does form data end up, who can see it, and is anything sensitive being emailed around?"

6. What third-party code runs on your site?

Analytics tools, advertising pixels, chat widgets, booking tools and embedded videos all load code from other companies onto your pages. Each one is useful, and each one is a dependency you do not control. If one of those providers is compromised or changes what its code does, your website changes with it.

This does not mean avoiding third-party tools. It means keeping a list of what is installed, removing anything no longer used, and being deliberate about adding new ones.

Ask: "Can you give me a list of every external script on the site and what each one is for?"

7. Are the basics in place?

A few technical foundations should be standard on any professional website today:

HTTPS on every page, so information between visitors and your site is encrypted.
Security headers that tell browsers how to handle your content safely.
Administrator areas that are not left open to anyone who guesses the address and a password.
Error pages that do not reveal technical details about how the site is built.

You do not need to understand how each of these works. You do need a developer who can explain, in plain language, what they have done about them.

Red flags when hiring a developer

Be cautious if a developer or agency:

Wants to register your domain or hosting in their own name.
Shares one login across their whole team.
Has no answer for how updates will happen after launch.
Cannot explain where backups are stored or how a restore would work.
Installs a new plugin for every small feature without discussing it.

None of these automatically means someone is careless, but each is worth a direct conversation before you sign anything.

How we approach it at FilteDev

FilteDev is led by an engineer who spent two years working full time in information security before returning to development, including work on websites delivered under HIPAA obligations for healthcare organizations. That background shapes how every project here is built: accounts stay in the client's name, access is limited to what each person needs, updates and backups are planned before launch, and every third-party tool is there for a reason.

Security is not a separate package or an upsell. It is part of building a website properly.

If you would like a second opinion on your current website, or you are planning a new one, send us a short brief and we will tell you honestly where you stand.

HubSpot CMS or WordPress? How service businesses should choose

edmond@filtedev.com (Edmond Dema) — Sat, 26 Sep 2026 12:34:49 GMT

If you run a service business and you are planning a new website, the platform question comes up early: HubSpot CMS or WordPress? Both are mature, both power a huge number of business websites, and both can produce a fast, professional site in the right hands.

The honest answer is that neither is better in general. Each is better for a particular kind of business. As a studio that builds on both, here is how we help clients decide.

The short version

HubSpot CMS suits businesses that already use HubSpot for sales or marketing, want their website and customer data in one place, and would rather pay a predictable subscription than manage hosting, updates and plugins.
WordPress suits businesses that want maximum flexibility and control, need features that a plugin ecosystem does well (such as complex e-commerce or membership sites), or want to keep ongoing platform costs low and are comfortable arranging maintenance.

The rest of this article explains the trade-offs behind those recommendations.

Cost: subscription versus assembled

HubSpot's content platform is a subscription. Hosting, security certificates, a content delivery network and platform updates are included, and the price depends on the plan tier. Check HubSpot's current pricing for exact numbers, because plans and features change.

WordPress itself is free and open source, but a working business website is not. You pay for hosting, often for premium themes or plugins, and for someone's time to keep everything updated. The total can be lower than HubSpot, or higher, depending on how much you rely on paid plugins and professional maintenance.

The useful comparison is not the headline price. It is the total cost of running the site properly for three years, including maintenance.

Editing: who will update the site?

Both platforms let non-technical people edit pages. HubSpot's drag-and-drop editor works well when the site is built with reusable modules, so marketers can add sections without breaking the design. WordPress's block editor is similarly capable, and many teams already know it.

In practice, ease of editing depends more on how the site was built than on the platform. A well-structured site is easy to edit on either. A poorly built one is painful on both.

Security and maintenance

This is where the two differ most. HubSpot is a managed platform: the hosting, the server software and the core system are maintained by HubSpot, so there is no core software or plugin stack for you to keep patched.

WordPress can be very secure, but its security depends on maintenance. Most compromised WordPress sites are not attacked through WordPress itself but through outdated plugins or themes, weak passwords, or poorly configured hosting. With a clear update schedule, good hosting and restrained plugin use, WordPress is a safe choice. Without them, it becomes a liability over time.

If nobody in your business will own maintenance and you do not plan to pay someone to, that is a strong argument for a managed platform.

CRM and marketing integration

HubSpot's biggest advantage is that the website and the CRM are the same system. Form submissions become contacts automatically, you can see which pages a lead visited before getting in touch, and content can be personalised for existing contacts without connecting separate tools.

WordPress can connect to HubSpot and other CRMs through plugins and integrations, and for many businesses that is enough. It is one more connection to set up and maintain, and some features available natively inside HubSpot are more limited when the website sits outside it.

Flexibility

WordPress wins on raw flexibility. Its plugin ecosystem covers almost anything, you can host it wherever you like, and developers can change any part of the system. Complex e-commerce, membership areas and unusual custom functionality are generally easier to build on WordPress.

HubSpot is flexible within its framework. Custom themes, modules and templates allow fully bespoke designs, and it handles typical service business needs well: service pages, landing pages, blogs, forms and gated content. It is less suited to heavy custom application logic.

Lock-in and ownership

With WordPress, you can export your site and move it to another host at any time. With HubSpot, your content lives on HubSpot's platform. You can export content and move away, but the templates and some features will need rebuilding elsewhere.

Neither is a reason to avoid a platform. It is a reason to make sure that, whichever you choose, the accounts are registered in your business's name and the design and code are yours.

When we recommend HubSpot CMS

You already use HubSpot for your CRM or marketing.
Your marketing team wants to build landing pages and campaigns without a developer.
Nobody will own ongoing technical maintenance.
You value predictable costs over the lowest possible monthly spend.

When we recommend WordPress

You need complex e-commerce, memberships or features best served by established plugins.
You want full control over hosting and the underlying code.
You have, or will pay for, reliable ongoing maintenance.
Your CRM is not HubSpot, or your needs are simple enough that deep integration does not matter.

Questions to ask before you decide

Which CRM do we use now, and will we still use it in three years?
Who will edit the website each month, and how technical are they?
Who will handle updates, backups and security?
What will the site cost to run properly over three years on each platform?
Are there features we need that one platform handles much better than the other?

Need a second opinion?

FilteDev builds HubSpot CMS websites and custom themes, WordPress sites, and migrations between the two. If you are weighing up the options, send us a short brief and we will recommend the platform that fits your business, even if that means suggesting you stay where you are.