[{"data":1,"prerenderedAt":1708},["ShallowReactive",2],{"footer-site-constant":3,"published-insights":51},{"id":4,"address":5,"companyName":6,"companyRegistrationNumber":7,"email":8,"extension":9,"fax":10,"latitude":11,"longitude":12,"meta":13,"opening_hours":14,"phone":27,"social_media_links":28,"stem":49,"__hash__":50},"siteConstants\u002Fsite-constants\u002Fconstants.json","\u003Cp>SS-19-10, Stellar Suites,\u003Cbr>Jalan Puteri 4\u002F7, Bandar Puteri,\u003Cbr>47100 Puchong,\u003Cbr>Selangor, Malaysia.\u003C\u002Fp>","Orangesoft Sdn Bhd","200701012044 (770049-P)","sales@os.my","json","","3.017778","101.613917",{},[15,19,21,23,25],{"dayOfWeek":16,"opens":17,"closes":18},"Monday","09:00","18:00",{"dayOfWeek":20,"opens":17,"closes":18},"Tuesday",{"dayOfWeek":22,"opens":17,"closes":18},"Wednesday",{"dayOfWeek":24,"opens":17,"closes":18},"Thursday",{"dayOfWeek":26,"opens":17,"closes":18},"Friday","+603-7890 3113",[29,34,39,44],{"label":30,"url":31,"icon":32,"iconClass":33},"Facebook","https:\u002F\u002Fwww.facebook.com\u002Forangesoft",{"url":10},"pi pi-facebook",{"label":35,"url":36,"icon":37,"iconClass":38},"Twitter","https:\u002F\u002Ftwitter.com\u002Forangesoft",{"url":10},"pi pi-twitter",{"label":40,"url":41,"icon":42,"iconClass":43},"Instagram","https:\u002F\u002Fwww.instagram.com\u002Forangesoftwebdesign\u002F",{"url":10},"pi pi-instagram",{"label":45,"url":46,"icon":47,"iconClass":48},"Linkedin","https:\u002F\u002Fwww.linkedin.com\u002Fcompany\u002Forangesoft-interactive\u002F",{"url":10},"pi pi-linkedin","site-constants\u002Fconstants","yKKIgU_2QjZGQV3S7a5I6MIVOAKLayjJ9njwAsgMJMU",[52,270,462,682,862,1041,1238,1434],{"id":53,"title":54,"author":55,"body":56,"description":258,"extension":259,"meta":260,"navigation":261,"path":262,"publishedAt":263,"relatedService":264,"seo":265,"status":266,"stem":267,"targetKeyword":268,"updatedAt":263,"__hash__":269},"articles\u002Farticles\u002Fwebsite-maintenance-checklist-malaysia.md","Website Maintenance Checklist for Malaysian Businesses","Webmasters.my",{"type":57,"value":58,"toc":241},"minimark",[59,63,66,71,90,93,97,102,105,108,112,115,119,122,126,129,133,136,140,160,163,167,170,173,177,180,202,205,209,212,216],[60,61,62],"p",{},"Most business websites do not fail because of one dramatic decision. They become unreliable through small omissions: an update that keeps getting postponed, a form nobody tests, a domain renewal owned by a former employee, or a backup that has never been restored.",[60,64,65],{},"A useful maintenance checklist should prevent those gaps without turning a marketing manager into a system administrator. The aim is clear ownership and evidence that the important work happened.",[67,68,70],"h2",{"id":69},"every-week-watch-the-customer-facing-essentials","Every week: watch the customer-facing essentials",[72,73,74,78,81,84,87],"ul",{},[75,76,77],"li",{},"Confirm the home page and important landing pages load normally.",[75,79,80],{},"Submit each lead or enquiry form and confirm the message reaches the intended person.",[75,82,83],{},"Check important transactions, logins or booking steps where applicable.",[75,85,86],{},"Review uptime or incident alerts and assign any follow-up.",[75,88,89],{},"Look for unexpected pages, redirects, pop-ups or browser warnings.",[60,91,92],{},"This is a short operational check, not a security audit. It catches visible problems before customers have to report them.",[67,94,96],{"id":95},"every-month-maintain-the-working-website","Every month: maintain the working website",[98,99,101],"h3",{"id":100},"review-software-and-dependencies","Review software and dependencies",[60,103,104],{},"Identify updates for the CMS, extensions, themes, framework packages and connected services. Do not treat every update as a blind “update all” exercise. Check compatibility, confirm a current backup and define the important journeys to test afterwards.",[60,106,107],{},"WordPress advises site owners to keep plugins and themes current and recommends a current backup before updating. Its automatic-update feature is opt-in for individual plugins and themes, so enabling it is a decision—not proof that every part of the website is covered.",[98,109,111],{"id":110},"verify-backups-and-recovery-readiness","Verify backups and recovery readiness",[60,113,114],{},"Confirm that backups completed, are stored somewhere appropriate and cover the files and data needed to restore the website. Periodically test the restore process. A green “backup completed” message is not the same as a proven recovery route.",[98,116,118],{"id":117},"check-forms-integrations-and-notifications","Check forms, integrations and notifications",[60,120,121],{},"Test contact forms, email delivery, CRM connections, payment notifications and any other route that moves a customer enquiry into the business. Check both the user confirmation and the internal notification.",[98,123,125],{"id":124},"review-access","Review access",[60,127,128],{},"Remove former staff and vendor accounts that are no longer needed. Confirm that administrators use individual accounts rather than one shared login. Record who owns the domain, hosting, analytics and third-party services.",[98,130,132],{"id":131},"review-website-health","Review website health",[60,134,135],{},"Look for broken links, missing images, certificate issues, crawl errors, unusual traffic changes and obvious performance regressions. The goal is to identify a change that deserves investigation, not to chase a perfect score in every tool.",[67,137,139],{"id":138},"every-quarter-improve-do-not-merely-preserve","Every quarter: improve, do not merely preserve",[72,141,142,145,148,151,154,157],{},[75,143,144],{},"Review whether priority pages still match current services and customer questions.",[75,146,147],{},"Check mobile journeys on a real phone.",[75,149,150],{},"Review search performance and queries that are beginning to gain impressions.",[75,152,153],{},"Identify outdated claims, people, prices, dates and downloadable files.",[75,155,156],{},"Choose one or two improvements to speed, usability or conversion.",[75,158,159],{},"Revisit the support backlog and remove work that is no longer valuable.",[60,161,162],{},"Maintenance becomes more useful when it creates momentum. A website that is technically current but commercially stale is only partly maintained.",[67,164,166],{"id":165},"every-year-confirm-ownership-and-lifecycle","Every year: confirm ownership and lifecycle",[60,168,169],{},"Review the domain registrant, DNS, hosting, licences, repositories, source files, analytics ownership and emergency contacts. Confirm renewal dates and payment methods are controlled by the organisation.",[60,171,172],{},"Then review the technology lifecycle. Is the CMS or framework version still supported? Are important plugins or packages abandoned? Is the hosting runtime compatible with the next supported version? Major upgrades are easier to plan a year early than a week late.",[67,174,176],{"id":175},"give-every-check-three-things","Give every check three things",[60,178,179],{},"For each maintenance item, record:",[181,182,183,190,196],"ol",{},[75,184,185,189],{},[186,187,188],"strong",{},"Owner:"," the person or provider accountable for doing it.",[75,191,192,195],{},[186,193,194],{},"Evidence:"," the report, log, test result or ticket showing it happened.",[75,197,198,201],{},[186,199,200],{},"Escalation:"," what triggers investigation or approval.",[60,203,204],{},"That simple structure turns a checklist into an operating rhythm.",[67,206,208],{"id":207},"when-to-bring-in-a-website-care-team","When to bring in a website care team",[60,210,211],{},"External support is worth considering when checks are repeatedly skipped, knowledge sits with one person, updates feel risky, or ordinary changes take too long to arrange. Start with a review of the current site and its ownership gaps. The right maintenance scope should follow the real website—not a generic package list.",[67,213,215],{"id":214},"sources","Sources",[72,217,218,227,234],{},[75,219,220],{},[221,222,226],"a",{"href":223,"rel":224},"https:\u002F\u002Fwordpress.org\u002Fdocumentation\u002Farticle\u002Fplugins-themes-auto-updates\u002F",[225],"nofollow","WordPress: Plugins and themes auto-updates",[75,228,229],{},[221,230,233],{"href":231,"rel":232},"https:\u002F\u002Fwordpress.org\u002Fdocumentation\u002Farticle\u002Fmanage-plugins\u002F",[225],"WordPress: Manage Plugins",[75,235,236],{},[221,237,240],{"href":238,"rel":239},"https:\u002F\u002Fwww.drupal.org\u002Fdocs\u002Fupdating-drupal",[225],"Drupal: Updating Drupal",{"title":10,"searchDepth":242,"depth":242,"links":243},2,[244,245,253,254,255,256,257],{"id":69,"depth":242,"text":70},{"id":95,"depth":242,"text":96,"children":246},[247,249,250,251,252],{"id":100,"depth":248,"text":101},3,{"id":110,"depth":248,"text":111},{"id":117,"depth":248,"text":118},{"id":124,"depth":248,"text":125},{"id":131,"depth":248,"text":132},{"id":138,"depth":242,"text":139},{"id":165,"depth":242,"text":166},{"id":175,"depth":242,"text":176},{"id":207,"depth":242,"text":208},{"id":214,"depth":242,"text":215},"A practical monthly, quarterly and annual website maintenance checklist for Malaysian teams that need clear ownership—not more technical noise.","md",{},true,"\u002Farticles\u002Fwebsite-maintenance-checklist-malaysia","2026-08-01T16:02:00+08:00","website-maintenance-malaysia",{"title":54,"description":258},"published","articles\u002Fwebsite-maintenance-checklist-malaysia","website maintenance checklist Malaysia","rI6EDv_3ohwnDW6z09olKNJ6nyIbOTRLrOavTWQRr2Y",{"id":271,"title":272,"author":55,"body":273,"description":453,"extension":259,"meta":454,"navigation":261,"path":455,"publishedAt":456,"relatedService":457,"seo":458,"status":266,"stem":459,"targetKeyword":460,"updatedAt":456,"__hash__":461},"articles\u002Farticles\u002Fprevious-website-developer-disappears.md","What to Do When Your Previous Website Developer Disappears",{"type":57,"value":274,"toc":442},[275,278,281,285,288,291,308,311,315,318,347,350,354,357,360,364,367,371,374,377,397,401,404,407,411,414,417,421,424,426],[60,276,277],{},"The website is still online, but the person who built it no longer replies. This is stressful because the visible website is only one part of what the business may depend on: the domain, DNS, hosting, source code, database, email delivery, licences and third-party accounts can all have different owners.",[60,279,280],{},"Do not begin by changing everything. Begin by establishing what the organisation already controls.",[67,282,284],{"id":283},"first-protect-the-business-records-you-have","First: protect the business records you have",[60,286,287],{},"Collect invoices, contracts, renewal emails, project handover documents and messages that mention the domain, hosting or website accounts. Save them somewhere controlled by the company.",[60,289,290],{},"Search company email for terms such as:",[72,292,293,296,299,302,305],{},[75,294,295],{},"domain, registrar, DNS or nameserver;",[75,297,298],{},"hosting, server, cloud or cPanel;",[75,300,301],{},"WordPress, Drupal, Laravel, Strapi or CMS;",[75,303,304],{},"GitHub, GitLab, Bitbucket or repository;",[75,306,307],{},"SSL, CDN, Cloudflare, analytics, payment or SMTP.",[60,309,310],{},"These records often reveal the providers even when nobody remembers the setup.",[67,312,314],{"id":313},"identify-the-ownership-layers","Identify the ownership layers",[60,316,317],{},"Build a simple table with four columns: asset, provider, current owner and access status. Include at least:",[181,319,320,323,326,329,332,335,338,341,344],{},[75,321,322],{},"Domain registration",[75,324,325],{},"DNS",[75,327,328],{},"Hosting or cloud account",[75,330,331],{},"CMS administrator access",[75,333,334],{},"Source-code repository",[75,336,337],{},"Database and file backups",[75,339,340],{},"Analytics and search tools",[75,342,343],{},"Forms, email delivery and CRM",[75,345,346],{},"Payment, maps and other third-party integrations",[60,348,349],{},"“The website login works” does not mean the company controls the domain or hosting. Each layer needs its own answer.",[67,351,353],{"id":352},"use-provider-recovery-processes","Use provider recovery processes",[60,355,356],{},"If access is missing, contact the relevant provider using an authorised company email and the evidence it requests. Avoid asking a new developer to “break into” an account or work around ownership checks. Legitimate providers have recovery and verification processes precisely because these services are valuable assets.",[60,358,359],{},"If an account belongs to a former employee or vendor, ask the provider what documentation is needed to transfer control. Keep the communication in company records.",[67,361,363],{"id":362},"do-not-share-passwords-in-a-general-enquiry","Do not share passwords in a general enquiry",[60,365,366],{},"A website specialist can begin with the public URL and your ownership map. When access is needed, use individual accounts, provider invitations or a secure credential-sharing method. Do not paste administrator or hosting passwords into an ordinary contact form or email thread.",[67,368,370],{"id":369},"establish-a-backup-before-routine-changes","Establish a backup before routine changes",[60,372,373],{},"Once authorised access is recovered, create or verify a backup before updating plugins, dependencies or configuration. An undocumented website may contain custom code that does not tolerate a rushed “update everything” action.",[60,375,376],{},"The first technical review should identify:",[72,378,379,382,385,388,391,394],{},[75,380,381],{},"the platform and current version;",[75,383,384],{},"custom themes, modules, plugins or packages;",[75,386,387],{},"available environments and deployment method;",[75,389,390],{},"forms and business-critical journeys;",[75,392,393],{},"known errors or compromise indicators;",[75,395,396],{},"whether the website is on a supported software branch.",[67,398,400],{"id":399},"separate-takeover-work-from-ongoing-maintenance","Separate takeover work from ongoing maintenance",[60,402,403],{},"The site may be ready for routine care, but it may first need stabilisation. Typical one-off work includes access transfer, overdue updates, backup setup, unsupported component replacement, malware recovery, repository reconstruction or hosting changes.",[60,405,406],{},"Ask a new support team to label these separately. That prevents an apparently simple maintenance arrangement from hiding an unknown recovery project.",[67,408,410],{"id":409},"if-the-site-shows-signs-of-compromise","If the site shows signs of compromise",[60,412,413],{},"Treat suspicious redirects, unknown administrators, spam pages or browser warnings as an incident. Preserve the available evidence, contact the host if containment is urgent, and avoid installing random cleanup tools.",[60,415,416],{},"WordPress’s hacked-site guidance recommends documenting symptoms, checking the host and local computers, resetting access, creating a backup or snapshot, removing the compromise, updating software and changing passwords again afterwards. The details vary by platform, but the sequence matters: understand, contain, recover and harden.",[67,418,420],{"id":419},"the-outcome-you-want","The outcome you want",[60,422,423],{},"A successful takeover is not merely “the new developer can log in.” The organisation should know what it owns, where it is hosted, how it is backed up, how changes are released and who is accountable next time something goes wrong.",[67,425,215],{"id":214},[72,427,428,435],{},[75,429,430],{},[221,431,434],{"href":432,"rel":433},"https:\u002F\u002Fwordpress.org\u002Fdocumentation\u002Farticle\u002Ffaq-my-site-was-hacked\u002F",[225],"WordPress: FAQ — My site was hacked",[75,436,437],{},[221,438,441],{"href":439,"rel":440},"https:\u002F\u002Flookup.icann.org\u002F",[225],"ICANN Lookup",{"title":10,"searchDepth":242,"depth":242,"links":443},[444,445,446,447,448,449,450,451,452],{"id":283,"depth":242,"text":284},{"id":313,"depth":242,"text":314},{"id":352,"depth":242,"text":353},{"id":362,"depth":242,"text":363},{"id":369,"depth":242,"text":370},{"id":399,"depth":242,"text":400},{"id":409,"depth":242,"text":410},{"id":419,"depth":242,"text":420},{"id":214,"depth":242,"text":215},"A calm first-response plan for recovering website ownership, protecting access and deciding what to do next when a developer stops responding.",{},"\u002Farticles\u002Fprevious-website-developer-disappears","2026-08-01T16:01:00+08:00","website-takeover-support",{"title":272,"description":453},"articles\u002Fprevious-website-developer-disappears","website developer disappeared Malaysia","4fQqdFBrh0C62efzGy0itzINl5AelrS3VigOHLyDwZM",{"id":463,"title":464,"author":55,"body":465,"description":674,"extension":259,"meta":675,"navigation":261,"path":676,"publishedAt":677,"relatedService":264,"seo":678,"status":266,"stem":679,"targetKeyword":680,"updatedAt":677,"__hash__":681},"articles\u002Farticles\u002Fwebsite-maintenance-cost-malaysia.md","How Much Does Website Maintenance Cost in Malaysia?",{"type":57,"value":466,"toc":654},[467,470,473,477,481,484,488,491,495,498,502,505,509,512,516,519,523,526,558,561,565,569,572,576,579,583,586,590,593,597,600,626,630,633,635],[60,468,469],{},"The honest answer is that website maintenance does not have one useful market price. Two sites with the same number of pages can have completely different support needs: one is a stable brochure site; the other handles payments, customer data, custom integrations and weekly campaigns.",[60,471,472],{},"Instead of beginning with a monthly figure, compare what the fee is responsible for.",[67,474,476],{"id":475},"the-six-factors-that-change-maintenance-cost","The six factors that change maintenance cost",[98,478,480],{"id":479},"_1-platform-and-technical-complexity","1. Platform and technical complexity",[60,482,483],{},"A conventional CMS site, a customised WordPress installation, a Composer-managed Drupal project, a Laravel application and a headless CMS stack do not require the same expertise or workflow. Custom code, abandoned extensions and unusual integrations add investigation and testing.",[98,485,487],{"id":486},"_2-current-condition","2. Current condition",[60,489,490],{},"A healthy, documented website is cheaper to take responsibility for than one with overdue updates, missing backups, unsupported software and unclear access. A provider may separate one-off stabilisation from the recurring plan. That is often more transparent than hiding unknown remedial work inside a low monthly fee.",[98,492,494],{"id":493},"_3-business-criticality","3. Business criticality",[60,496,497],{},"If the website generates enquiries, takes payment, serves logged-in users or supports operations, downtime and broken journeys have a larger consequence. The maintenance plan may need more frequent checks, more deliberate testing and clearer incident handling.",[98,499,501],{"id":500},"_4-volume-of-change","4. Volume of change",[60,503,504],{},"Some organisations need only routine upkeep. Others need page edits, graphics, landing pages, integrations and continuous improvements. Compare whether the plan includes a support allocation, how unused time is handled and what becomes a separate quote.",[98,506,508],{"id":507},"_5-response-expectations","5. Response expectations",[60,510,511],{},"“Support included” is incomplete. Ask when requests are acknowledged, how priorities are defined, what counts as an emergency and whether after-hours work is available. Faster or guaranteed coverage normally requires more capacity to be reserved.",[98,513,515],{"id":514},"_6-depth-of-assurance","6. Depth of assurance",[60,517,518],{},"There is a difference between installing updates and maintaining with backup checks, staging, compatibility review, post-release testing and reporting. The plan should say what evidence you receive and which journeys are tested.",[67,520,522],{"id":521},"what-a-useful-quotation-should-show","What a useful quotation should show",[60,524,525],{},"Look for these components:",[72,527,528,531,534,537,540,543,546,549,552,555],{},[75,529,530],{},"routine software and dependency maintenance;",[75,532,533],{},"backup and restore responsibilities;",[75,535,536],{},"health, uptime and security checks;",[75,538,539],{},"form and critical-journey testing;",[75,541,542],{},"content, design or development allowance;",[75,544,545],{},"response and escalation expectations;",[75,547,548],{},"reporting or recommendations;",[75,550,551],{},"exclusions and separately scoped work;",[75,553,554],{},"onboarding or stabilisation fees;",[75,556,557],{},"hosting, licences and third-party charges.",[60,559,560],{},"If these are missing, two monthly prices are not truly comparable.",[67,562,564],{"id":563},"common-pricing-structures","Common pricing structures",[98,566,568],{"id":567},"essential-care-retainer","Essential care retainer",[60,570,571],{},"This covers a defined maintenance rhythm and monitoring baseline. It suits a stable website that changes infrequently but still needs clear ownership.",[98,573,575],{"id":574},"care-plus-support-allocation","Care plus support allocation",[60,577,578],{},"The recurring fee includes both maintenance and an agreed amount of content, design or development assistance. It suits active marketing teams that regularly need help.",[98,580,582],{"id":581},"dedicated-improvement-partnership","Dedicated improvement partnership",[60,584,585],{},"The provider maintains the site and reserves capacity for a roadmap of performance, user-experience or conversion work. It suits organisations treating the website as an active business channel.",[98,587,589],{"id":588},"one-off-support","One-off support",[60,591,592],{},"Ad hoc work can be appropriate for a specific issue, but it does not create ongoing ownership. Repeated emergency jobs can become expensive because every incident begins with rediscovery.",[67,594,596],{"id":595},"questions-that-reveal-valuenot-just-price","Questions that reveal value—not just price",[60,598,599],{},"Ask each provider:",[181,601,602,605,608,611,614,617,620,623],{},[75,603,604],{},"What do you inspect before taking responsibility?",[75,606,607],{},"What happens before and after an update?",[75,609,610],{},"Who owns backups and when was recovery last tested?",[75,612,613],{},"Are content and development requests included?",[75,615,616],{},"How are urgent and routine requests distinguished?",[75,618,619],{},"What is excluded?",[75,621,622],{},"What happens if the website is already compromised or unsupported?",[75,624,625],{},"Who in the team will know our website six months from now?",[67,627,629],{"id":628},"start-with-the-current-website","Start with the current website",[60,631,632],{},"The most useful first step is a review of the public site and the context you share. A deeper quotation may then require secure access to identify versions, dependencies, hosting and custom work. The cost should follow the evidence and the responsibility you want the provider to carry.",[67,634,215],{"id":214},[72,636,637,642,647],{},[75,638,639],{},[221,640,233],{"href":231,"rel":641},[225],[75,643,644],{},[221,645,240],{"href":238,"rel":646},[225],[75,648,649],{},[221,650,653],{"href":651,"rel":652},"https:\u002F\u002Flaravel.com\u002Fdocs\u002Freleases",[225],"Laravel: Release notes and support policy",{"title":10,"searchDepth":242,"depth":242,"links":655},[656,664,665,671,672,673],{"id":475,"depth":242,"text":476,"children":657},[658,659,660,661,662,663],{"id":479,"depth":248,"text":480},{"id":486,"depth":248,"text":487},{"id":493,"depth":248,"text":494},{"id":500,"depth":248,"text":501},{"id":507,"depth":248,"text":508},{"id":514,"depth":248,"text":515},{"id":521,"depth":242,"text":522},{"id":563,"depth":242,"text":564,"children":666},[667,668,669,670],{"id":567,"depth":248,"text":568},{"id":574,"depth":248,"text":575},{"id":581,"depth":248,"text":582},{"id":588,"depth":248,"text":589},{"id":595,"depth":242,"text":596},{"id":628,"depth":242,"text":629},{"id":214,"depth":242,"text":215},"A practical way to compare website maintenance costs in Malaysia by scope, risk, response and the condition of the existing website.",{},"\u002Farticles\u002Fwebsite-maintenance-cost-malaysia","2026-08-01T16:00:00+08:00",{"title":464,"description":674},"articles\u002Fwebsite-maintenance-cost-malaysia","website maintenance cost Malaysia","VsphoQ6la8qnzbdZz0Guhb2GsWZZ6OjJeD9fM02VmSk",{"id":683,"title":684,"author":55,"body":685,"description":853,"extension":259,"meta":854,"navigation":261,"path":855,"publishedAt":856,"relatedService":857,"seo":858,"status":266,"stem":859,"targetKeyword":860,"updatedAt":856,"__hash__":861},"articles\u002Farticles\u002Fhow-often-wordpress-plugins-updated.md","How Often Should WordPress Plugins Be Updated?",{"type":57,"value":686,"toc":839},[687,690,693,697,700,703,707,710,713,736,740,743,746,750,753,757,760,764,767,771,774,777,781,804,808,811,815,818,820],[60,688,689],{},"There is no responsible answer such as “every Tuesday” that fits every WordPress site and every plugin. The right timing depends on why the update exists, whether the site is exposed to the issue, how critical the plugin is and how safely your team can verify the change.",[60,691,692],{},"The better rule is: review updates regularly, act promptly on relevant security fixes, and apply other changes through a tested maintenance rhythm.",[67,694,696],{"id":695},"why-waiting-indefinitely-is-risky","Why waiting indefinitely is risky",[60,698,699],{},"Plugin releases can contain security fixes, compatibility changes, bug fixes and new features. WordPress advises keeping plugins and themes updated, and its plugin-management documentation notes that updates can improve security and performance.",[60,701,702],{},"An update notification is not proof that your site is vulnerable, but ignoring all updates creates an expanding gap between the site and the versions developers actively support.",[67,704,706],{"id":705},"why-updating-immediately-can-also-cause-trouble","Why updating immediately can also cause trouble",[60,708,709],{},"A WordPress site is an application made from interacting parts: core, theme, plugins, PHP, hosting configuration and custom code. A change to one part can affect another.",[60,711,712],{},"Before updating, consider:",[72,714,715,718,721,724,727,730,733],{},[75,716,717],{},"Is this a security release, bug fix or feature release?",[75,719,720],{},"Does the release note mention a breaking change?",[75,722,723],{},"Is the plugin compatible with the current WordPress and PHP versions?",[75,725,726],{},"Does the site use custom code that depends on the plugin?",[75,728,729],{},"Is a current, restorable backup available?",[75,731,732],{},"Can the update be checked on staging first?",[75,734,735],{},"Which customer journeys must be tested afterwards?",[67,737,739],{"id":738},"a-practical-review-cadence","A practical review cadence",[60,741,742],{},"For many business sites, a weekly review of available updates is a useful operational starting point. That does not mean blindly installing every update weekly. It means someone is accountable for classifying what changed and deciding the next action.",[60,744,745],{},"Use three lanes:",[98,747,749],{"id":748},"urgent-review","Urgent review",[60,751,752],{},"Relevant security fixes, actively exploited issues or releases tied to a current incident should be assessed promptly. The response may include mitigation, an update, temporary deactivation or another controlled action.",[98,754,756],{"id":755},"routine-maintenance","Routine maintenance",[60,758,759],{},"Normal bug-fix and compatibility releases can move through the regular backup, update and testing process.",[98,761,763],{"id":762},"planned-change","Planned change",[60,765,766],{},"Major versions, replacement plugins and updates with known breaking changes deserve a scheduled mini-project rather than a routine maintenance slot.",[67,768,770],{"id":769},"what-auto-updates-doand-do-not-do","What auto-updates do—and do not do",[60,772,773],{},"WordPress allows automatic updates to be enabled separately for plugins and themes. Its documentation explains that these checks rely on the WordPress scheduled-task system and recommends backups.",[60,775,776],{},"Auto-updates can reduce exposure time for selected low-risk components, but they do not decide whether a change is compatible with custom code, verify a payment or enquiry journey, or investigate why an update failed. Use them as one control within a maintenance approach, not as the whole approach.",[67,778,780],{"id":779},"a-safer-update-workflow","A safer update workflow",[181,782,783,786,789,792,795,798,801],{},[75,784,785],{},"Review the release and relevance.",[75,787,788],{},"Confirm a current backup and recovery path.",[75,790,791],{},"Apply the update on staging when the site or change warrants it.",[75,793,794],{},"Check for visible errors and system warnings.",[75,796,797],{},"Test the forms, checkout, login and other important journeys.",[75,799,800],{},"Record what changed and any follow-up.",[75,802,803],{},"Keep rollback access until the change is proven stable.",[67,805,807],{"id":806},"signs-the-site-needs-more-than-plugin-updates","Signs the site needs more than plugin updates",[60,809,810],{},"If plugins are abandoned, licences have expired, PHP is unsupported, the theme contains heavy customisation or updates repeatedly break the site, the real need may be stabilisation or redevelopment. Continuing to press “update” does not resolve architectural debt.",[67,812,814],{"id":813},"the-short-answer","The short answer",[60,816,817],{},"Review plugin updates at least regularly enough that security and compatibility changes are not a surprise. Apply relevant security fixes promptly, move ordinary releases through a routine maintenance window, and plan major changes with proper testing. The exact cadence should match the website’s risk and complexity.",[67,819,215],{"id":214},[72,821,822,827,832],{},[75,823,824],{},[221,825,226],{"href":223,"rel":826},[225],[75,828,829],{},[221,830,233],{"href":231,"rel":831},[225],[75,833,834],{},[221,835,838],{"href":836,"rel":837},"https:\u002F\u002Fwordpress.org\u002Fdocumentation\u002Farticle\u002Fupdating-wordpress\u002F",[225],"WordPress: Updating WordPress",{"title":10,"searchDepth":242,"depth":242,"links":840},[841,842,843,848,849,850,851,852],{"id":695,"depth":242,"text":696},{"id":705,"depth":242,"text":706},{"id":738,"depth":242,"text":739,"children":844},[845,846,847],{"id":748,"depth":248,"text":749},{"id":755,"depth":248,"text":756},{"id":762,"depth":248,"text":763},{"id":769,"depth":242,"text":770},{"id":779,"depth":242,"text":780},{"id":806,"depth":242,"text":807},{"id":813,"depth":242,"text":814},{"id":214,"depth":242,"text":215},"Why WordPress plugin updates need a risk-based routine with backups, compatibility checks and post-update testing—not one universal schedule.",{},"\u002Farticles\u002Fhow-often-wordpress-plugins-updated","2026-08-01T15:59:00+08:00","wordpress-maintenance-malaysia",{"title":684,"description":853},"articles\u002Fhow-often-wordpress-plugins-updated","how often update WordPress plugins","4n4241Er-7XgnMTx-wksjrF7VdwJzOAwPFtTId3tvoA",{"id":863,"title":864,"author":55,"body":865,"description":1032,"extension":259,"meta":1033,"navigation":261,"path":1034,"publishedAt":1035,"relatedService":1036,"seo":1037,"status":266,"stem":1038,"targetKeyword":1039,"updatedAt":1035,"__hash__":1040},"articles\u002Farticles\u002Fwarning-signs-website-hacked.md","Warning Signs Your Business Website Has Been Hacked",{"type":57,"value":866,"toc":1017},[867,870,874,894,898,921,925,928,932,936,939,943,946,950,953,957,960,964,967,970,974,994,998,1001,1003],[60,868,869],{},"Some website compromises announce themselves with a warning page. Others stay quiet while adding spam, creating hidden accounts or redirecting only certain visitors. A single symptom does not prove the cause, but it should trigger a deliberate check.",[67,871,873],{"id":872},"visible-warning-signs","Visible warning signs",[72,875,876,879,882,885,888,891],{},[75,877,878],{},"Visitors are redirected to unrelated or suspicious websites.",[75,880,881],{},"Pages display text, links, pop-ups or advertisements your team did not publish.",[75,883,884],{},"Search results show pharmaceutical, gambling or other spam under your domain.",[75,886,887],{},"Browsers, search engines or the hosting provider warn that the site may be unsafe.",[75,889,890],{},"The homepage or important pages have been defaced.",[75,892,893],{},"Downloads appear that the organisation did not provide.",[67,895,897],{"id":896},"administrative-warning-signs","Administrative warning signs",[72,899,900,903,906,909,912,915,918],{},[75,901,902],{},"Unknown administrator accounts appear.",[75,904,905],{},"Legitimate users cannot log in or passwords change unexpectedly.",[75,907,908],{},"Plugins, modules, themes or extensions appear without explanation.",[75,910,911],{},"Files change outside an approved release.",[75,913,914],{},"Security, audit or server logs show unusual access.",[75,916,917],{},"Forms stop delivering, or they begin sending unexpected mail.",[75,919,920],{},"The host reports high resource use, spam or malicious processes.",[67,922,924],{"id":923},"quiet-operational-signs","Quiet operational signs",[60,926,927],{},"A hacked website can also present as a performance or reliability problem: unusual traffic, sudden server load, unexplained scheduled tasks, new API calls or intermittent redirects. These signs have innocent causes too, so treat them as evidence to investigate rather than a final diagnosis.",[67,929,931],{"id":930},"what-to-do-first","What to do first",[98,933,935],{"id":934},"record-the-symptoms","Record the symptoms",[60,937,938],{},"Take screenshots, note the exact URL, time, device and network, and save provider alerts. If the behaviour is intermittent, record how it was triggered. This helps distinguish the incident from a cache, browser extension or local-device issue.",[98,940,942],{"id":941},"contact-the-host-when-containment-is-urgent","Contact the host when containment is urgent",[60,944,945],{},"If customers are at risk, the host may be able to isolate or suspend the site while evidence is preserved. Understand the business impact before taking the site offline, but do not prioritise appearance over active harm.",[98,947,949],{"id":948},"preserve-a-snapshot","Preserve a snapshot",[60,951,952],{},"Before deleting files or restoring a backup, preserve the current state when it is safe and authorised to do so. A rushed restore may remove evidence, and a recent backup may already contain the compromise.",[98,954,956],{"id":955},"secure-the-access-route","Secure the access route",[60,958,959],{},"Review administrator, hosting, database, file-transfer and repository access. Password changes may be necessary, but if the device or account used to change them is compromised, the attacker may obtain the new credentials. Use a known-clean device and coordinate the sequence.",[98,961,963],{"id":962},"investigate-recover-and-update","Investigate, recover and update",[60,965,966],{},"The recovery route may be a known-clean backup, targeted cleanup or a controlled rebuild. Update the CMS, plugins, themes and dependencies after accounting for compatibility and custom code. Then change relevant credentials again and review the cause as far as the evidence allows.",[60,968,969],{},"WordPress’s official hacked-site guidance follows a similar progression: document the incident, scan the website and local environment, check with the host, reset access, create a backup or snapshot, remove the hack, update and harden.",[67,971,973],{"id":972},"what-not-to-do","What not to do",[72,975,976,979,982,985,988,991],{},[75,977,978],{},"Do not install multiple random cleanup plugins and hope one fixes everything.",[75,980,981],{},"Do not delete evidence before understanding the recovery options.",[75,983,984],{},"Do not assume the newest backup is clean.",[75,986,987],{},"Do not send passwords through an ordinary contact form.",[75,989,990],{},"Do not declare the site clean because the visible symptom disappeared.",[75,992,993],{},"Do not promise customers that no data was affected without evidence and appropriate advice.",[67,995,997],{"id":996},"after-the-site-is-back","After the site is back",[60,999,1000],{},"Recovery is not complete when the homepage loads. Check critical journeys, review access, rotate credentials, confirm software support, monitor for recurrence and establish ongoing maintenance. If personal or regulated data may be involved, the organisation should obtain appropriate legal, regulatory and incident-response advice.",[67,1002,215],{"id":214},[72,1004,1005,1010],{},[75,1006,1007],{},[221,1008,434],{"href":432,"rel":1009},[225],[75,1011,1012],{},[221,1013,1016],{"href":1014,"rel":1015},"https:\u002F\u002Fwww.drupal.org\u002Fsecurity",[225],"Drupal security advisories",{"title":10,"searchDepth":242,"depth":242,"links":1018},[1019,1020,1021,1022,1029,1030,1031],{"id":872,"depth":242,"text":873},{"id":896,"depth":242,"text":897},{"id":923,"depth":242,"text":924},{"id":930,"depth":242,"text":931,"children":1023},[1024,1025,1026,1027,1028],{"id":934,"depth":248,"text":935},{"id":941,"depth":248,"text":942},{"id":948,"depth":248,"text":949},{"id":955,"depth":248,"text":956},{"id":962,"depth":248,"text":963},{"id":972,"depth":242,"text":973},{"id":996,"depth":242,"text":997},{"id":214,"depth":242,"text":215},"Common visible and administrative signs of website compromise, plus the first actions to take without destroying useful evidence.",{},"\u002Farticles\u002Fwarning-signs-website-hacked","2026-08-01T15:58:00+08:00","wordpress-malware-removal",{"title":864,"description":1032},"articles\u002Fwarning-signs-website-hacked","signs website hacked","yN2o_VQcWdQCFQQVC7EPyq8VeUr8fB_SCzyFKxaJq7c",{"id":1042,"title":1043,"author":55,"body":1044,"description":1230,"extension":259,"meta":1231,"navigation":261,"path":1232,"publishedAt":1233,"relatedService":264,"seo":1234,"status":266,"stem":1235,"targetKeyword":1236,"updatedAt":1233,"__hash__":1237},"articles\u002Farticles\u002Fwebsite-maintenance-vs-managed-hosting.md","Website Maintenance vs Managed Hosting: What Is the Difference?",{"type":57,"value":1045,"toc":1217},[1046,1049,1052,1056,1059,1079,1082,1086,1089,1112,1115,1119,1122,1125,1129,1132,1152,1155,1169,1173,1177,1180,1184,1187,1191,1194,1198,1201,1203],[60,1047,1048],{},"Hosting and website maintenance are connected, but they are not interchangeable. Hosting provides the environment that makes the website available. Maintenance looks after the application, content, integrations and ongoing changes running in that environment.",[60,1050,1051],{},"“Managed” hosting adds provider assistance, but the exact boundary varies. The word does not automatically mean somebody is responsible for every plugin, form, checkout, content change or custom integration.",[67,1053,1055],{"id":1054},"what-hosting-normally-covers","What hosting normally covers",[60,1057,1058],{},"Depending on the provider and plan, hosting can include:",[72,1060,1061,1064,1067,1070,1073,1076],{},[75,1062,1063],{},"server or platform availability;",[75,1065,1066],{},"computing, storage and network resources;",[75,1068,1069],{},"certificates and basic platform configuration;",[75,1071,1072],{},"infrastructure backups;",[75,1074,1075],{},"operating-system or managed-runtime work;",[75,1077,1078],{},"platform monitoring and incident response.",[60,1080,1081],{},"The contract determines the real coverage. A self-managed server and a fully managed application platform are very different products.",[67,1083,1085],{"id":1084},"what-website-maintenance-normally-covers","What website maintenance normally covers",[60,1087,1088],{},"Website maintenance can include:",[72,1090,1091,1094,1097,1100,1103,1106,1109],{},[75,1092,1093],{},"CMS, plugin, module, theme or framework updates;",[75,1095,1096],{},"compatibility review and post-update checks;",[75,1098,1099],{},"website-level backups and recovery readiness;",[75,1101,1102],{},"form, checkout, login and integration testing;",[75,1104,1105],{},"bug fixes and content changes;",[75,1107,1108],{},"performance and SEO hygiene;",[75,1110,1111],{},"lifecycle planning and improvement recommendations.",[60,1113,1114],{},"These responsibilities sit closer to the application and the customer experience.",[67,1116,1118],{"id":1117},"where-the-gap-appears","Where the gap appears",[60,1120,1121],{},"Imagine that the server is online, but a plugin update breaks the enquiry form. The host may correctly say the infrastructure is healthy. The website is being served exactly as configured. Yet the business has stopped receiving leads.",[60,1123,1124],{},"Or the CMS may be healthy while the headless frontend fails to deploy. The CMS vendor, frontend host and development team each see a different layer. Without one person owning the complete journey, the issue can bounce between providers.",[67,1126,1128],{"id":1127},"compare-responsibilities-not-labels","Compare responsibilities, not labels",[60,1130,1131],{},"Ask the host:",[181,1133,1134,1137,1140,1143,1146,1149],{},[75,1135,1136],{},"Which software layers do you update?",[75,1138,1139],{},"Are application backups included, and who tests restoration?",[75,1141,1142],{},"Do you test forms, checkout and logins after changes?",[75,1144,1145],{},"Do you investigate custom code and third-party integrations?",[75,1147,1148],{},"What happens when the infrastructure is healthy but the website journey is broken?",[75,1150,1151],{},"Who coordinates an incident across multiple providers?",[60,1153,1154],{},"Then ask the website maintenance team:",[181,1156,1157,1160,1163,1166],{},[75,1158,1159],{},"Which hosting and infrastructure responsibilities are excluded?",[75,1161,1162],{},"Who receives platform alerts?",[75,1164,1165],{},"Can they work with the existing host?",[75,1167,1168],{},"How are access and escalation handled?",[67,1170,1172],{"id":1171},"three-workable-arrangements","Three workable arrangements",[98,1174,1176],{"id":1175},"separate-host-and-maintenance-partner","Separate host and maintenance partner",[60,1178,1179],{},"This works well when the responsibility boundary and escalation contacts are documented. The maintenance team handles the application; the host handles the infrastructure.",[98,1181,1183],{"id":1182},"one-provider-coordinating-both","One provider coordinating both",[60,1185,1186],{},"This can reduce handoffs, provided the quotation states which services are actually provided and which remain with third parties.",[98,1188,1190],{"id":1189},"managed-platform-plus-internal-web-team","Managed platform plus internal web team",[60,1192,1193],{},"An internal team can own the application and use a managed platform for infrastructure. The organisation still needs capacity for updates, testing, content and development.",[67,1195,1197],{"id":1196},"the-question-that-matters","The question that matters",[60,1199,1200],{},"Do not ask only, “Is our hosting managed?” Ask, “Who is accountable when a customer cannot complete the important journey?” The answer should name a person or team, the first checks they perform and how the issue moves across provider boundaries.",[67,1202,215],{"id":214},[72,1204,1205,1210],{},[75,1206,1207],{},[221,1208,838],{"href":836,"rel":1209},[225],[75,1211,1212],{},[221,1213,1216],{"href":1214,"rel":1215},"https:\u002F\u002Fsupport.strapi.io\u002Farticles\u002F6650214304-understanding-strapi-support-coverage",[225],"Strapi: Support coverage",{"title":10,"searchDepth":242,"depth":242,"links":1218},[1219,1220,1221,1222,1223,1228,1229],{"id":1054,"depth":242,"text":1055},{"id":1084,"depth":242,"text":1085},{"id":1117,"depth":242,"text":1118},{"id":1127,"depth":242,"text":1128},{"id":1171,"depth":242,"text":1172,"children":1224},[1225,1226,1227],{"id":1175,"depth":248,"text":1176},{"id":1182,"depth":248,"text":1183},{"id":1189,"depth":248,"text":1190},{"id":1196,"depth":242,"text":1197},{"id":214,"depth":242,"text":215},"A clear comparison of hosting, managed hosting and website maintenance—and the ownership gaps businesses should avoid.",{},"\u002Farticles\u002Fwebsite-maintenance-vs-managed-hosting","2026-08-01T15:57:00+08:00",{"title":1043,"description":1230},"articles\u002Fwebsite-maintenance-vs-managed-hosting","website maintenance vs managed hosting","RJz7W5dyoUWGHaJT-1EKpgMTNCHmHVxBGIcvvLR-pa0",{"id":1239,"title":1240,"author":55,"body":1241,"description":1426,"extension":259,"meta":1427,"navigation":261,"path":1428,"publishedAt":1429,"relatedService":264,"seo":1430,"status":266,"stem":1431,"targetKeyword":1432,"updatedAt":1429,"__hash__":1433},"articles\u002Farticles\u002Fhire-webmaster-or-outsource-support.md","Should You Hire a Webmaster or Outsource Website Support?",{"type":57,"value":1242,"toc":1411},[1243,1246,1249,1253,1256,1276,1279,1282,1286,1289,1309,1312,1316,1319,1322,1326,1329,1333,1336,1340,1343,1347,1350,1354,1357,1361,1364,1368,1371,1394,1398,1401,1404,1406],[60,1244,1245],{},"The decision is not simply employee versus agency. It is about how much website work exists, how varied that work is, how quickly it must move and how much continuity the organisation needs.",[60,1247,1248],{},"A traditional “webmaster” role can include content, design, analytics, CMS administration, development, hosting coordination and incident response. Few individuals are equally strong in all of those areas. Outsourced support provides a broader team, but it needs clear ownership and context to avoid becoming a ticket queue that never learns the business.",[67,1250,1252],{"id":1251},"hire-in-house-when-the-website-is-daily-operations","Hire in-house when the website is daily operations",[60,1254,1255],{},"An internal webmaster or web manager can be the right choice when:",[72,1257,1258,1261,1264,1267,1270,1273],{},[75,1259,1260],{},"the website changes throughout the working day;",[75,1262,1263],{},"deep product, policy or organisational knowledge is essential;",[75,1265,1266],{},"many departments need close coordination;",[75,1268,1269],{},"the workload consistently justifies a full-time role;",[75,1271,1272],{},"immediate internal availability matters;",[75,1274,1275],{},"the organisation can support the role with specialist help where needed.",[60,1277,1278],{},"The strongest advantage is proximity. An internal owner hears decisions early and can align the website with them.",[60,1280,1281],{},"The risks are role overload and single-person dependency. If one person holds every password, deployment step and piece of technical knowledge, the organisation has created continuity risk even while employing a webmaster.",[67,1283,1285],{"id":1284},"outsource-when-the-work-needs-a-team","Outsource when the work needs a team",[60,1287,1288],{},"External website support can be a good fit when:",[72,1290,1291,1294,1297,1300,1303,1306],{},[75,1292,1293],{},"the workload is important but not full-time;",[75,1295,1296],{},"needs span design, content, development and infrastructure;",[75,1298,1299],{},"the organisation wants continuity beyond one individual;",[75,1301,1302],{},"senior expertise is needed intermittently;",[75,1304,1305],{},"maintenance has been repeatedly postponed;",[75,1307,1308],{},"a previous developer or agency is handing over the site.",[60,1310,1311],{},"The advantage is access to multiple disciplines without hiring each one. The risk is distance from the business. A good provider counters that with a relationship lead, documentation, regular priorities and clear request handling.",[67,1313,1315],{"id":1314},"use-a-hybrid-model-when-ownership-and-execution-differ","Use a hybrid model when ownership and execution differ",[60,1317,1318],{},"Many organisations benefit from an internal website owner supported by an external care team.",[60,1320,1321],{},"The internal person owns priorities, approvals and business knowledge. The external team handles specialist implementation, maintenance, recovery readiness and technical continuity. This avoids expecting the marketing manager to be a developer or expecting the development provider to make business decisions.",[67,1323,1325],{"id":1324},"compare-the-real-operating-model","Compare the real operating model",[60,1327,1328],{},"Ask these questions:",[98,1330,1332],{"id":1331},"workload","Workload",[60,1334,1335],{},"How many content, design, support and development requests occur in a normal month? Are they predictable or campaign-driven?",[98,1337,1339],{"id":1338},"skill-range","Skill range",[60,1341,1342],{},"Does the website need one dominant skill or several? A content-heavy site may need a web producer; a custom application may need backend, frontend and infrastructure knowledge.",[98,1344,1346],{"id":1345},"response","Response",[60,1348,1349],{},"Which requests are truly urgent? What must happen during leave, illness or staff turnover?",[98,1351,1353],{"id":1352},"governance","Governance",[60,1355,1356],{},"Who approves changes, owns the domain and hosting, controls access and accepts risk?",[98,1358,1360],{"id":1359},"improvement","Improvement",[60,1362,1363],{},"Is the goal simply to keep the site online, or to improve search visibility, usability and conversion over time?",[67,1365,1367],{"id":1366},"warning-signs-in-either-model","Warning signs in either model",[60,1369,1370],{},"Be cautious when:",[72,1372,1373,1376,1379,1382,1385,1388,1391],{},[75,1374,1375],{},"knowledge and credentials belong to one person;",[75,1377,1378],{},"nobody can explain the backup and restore process;",[75,1380,1381],{},"“unlimited support” has no scope or response definition;",[75,1383,1384],{},"updates happen without testing;",[75,1386,1387],{},"every request starts with rediscovery;",[75,1389,1390],{},"the provider cannot distinguish hosting from application support;",[75,1392,1393],{},"the organisation has no internal decision owner.",[67,1395,1397],{"id":1396},"a-simple-decision-rule","A simple decision rule",[60,1399,1400],{},"If website work is continuous, deeply embedded in the business and sufficient for a full-time role, build strong internal ownership. If the workload is varied or intermittent and needs multiple disciplines, outsourced support is often more practical. If the website is important enough to require both business proximity and technical breadth, use a hybrid model.",[60,1402,1403],{},"Whichever route you choose, insist on shared documentation, organisation-owned accounts and a handover process. Continuity is an operating choice, not a job title.",[67,1405,215],{"id":214},[72,1407,1408],{},[75,1409,1410],{},"This guide is an original decision framework based on common website ownership, continuity and support considerations.",{"title":10,"searchDepth":242,"depth":242,"links":1412},[1413,1414,1415,1416,1423,1424,1425],{"id":1251,"depth":242,"text":1252},{"id":1284,"depth":242,"text":1285},{"id":1314,"depth":242,"text":1315},{"id":1324,"depth":242,"text":1325,"children":1417},[1418,1419,1420,1421,1422],{"id":1331,"depth":248,"text":1332},{"id":1338,"depth":248,"text":1339},{"id":1345,"depth":248,"text":1346},{"id":1352,"depth":248,"text":1353},{"id":1359,"depth":248,"text":1360},{"id":1366,"depth":242,"text":1367},{"id":1396,"depth":242,"text":1397},{"id":214,"depth":242,"text":215},"A decision framework for choosing an in-house webmaster, outsourced website support or a hybrid model based on workload, risk and continuity.",{},"\u002Farticles\u002Fhire-webmaster-or-outsource-support","2026-08-01T15:56:00+08:00",{"title":1240,"description":1426},"articles\u002Fhire-webmaster-or-outsource-support","hire webmaster or outsource website support","78LqNfm_M8_hvPC139sI1RgahwiWkp5FtrRtqRfkTck",{"id":1435,"title":1436,"author":55,"body":1437,"description":1700,"extension":259,"meta":1701,"navigation":261,"path":1702,"publishedAt":1703,"relatedService":457,"seo":1704,"status":266,"stem":1705,"targetKeyword":1706,"updatedAt":1703,"__hash__":1707},"articles\u002Farticles\u002Fsafely-take-over-existing-website.md","How to Safely Take Over an Existing Website",{"type":57,"value":1438,"toc":1688},[1439,1442,1445,1449,1452,1484,1487,1491,1494,1497,1501,1504,1536,1539,1543,1546,1566,1569,1573,1576,1602,1605,1609,1612,1615,1619,1622,1625,1629,1632,1655,1659,1662,1664],[60,1440,1441],{},"A planned website takeover should be treated like an operational handover, not a password exchange. The new team needs enough access and knowledge to keep the site running, recover it when necessary and make changes without guessing.",[60,1443,1444],{},"The safest sequence is inventory, transfer, preserve, verify, stabilise and then improve.",[67,1446,1448],{"id":1447},"_1-build-the-ownership-register","1. Build the ownership register",[60,1450,1451],{},"Record the provider, account owner, billing owner, renewal date and access status for:",[72,1453,1454,1457,1460,1463,1466,1469,1472,1475,1478,1481],{},[75,1455,1456],{},"domain registration and DNS;",[75,1458,1459],{},"hosting, cloud and CDN;",[75,1461,1462],{},"CMS administration;",[75,1464,1465],{},"source-code repositories;",[75,1467,1468],{},"deployment platforms and pipelines;",[75,1470,1471],{},"databases, file storage and backups;",[75,1473,1474],{},"analytics and search tools;",[75,1476,1477],{},"form email, SMTP and transactional email;",[75,1479,1480],{},"payment, CRM, maps and other integrations;",[75,1482,1483],{},"themes, plugins, modules, fonts and software licences.",[60,1485,1486],{},"Where possible, accounts should belong to the organisation rather than a vendor employee.",[67,1488,1490],{"id":1489},"_2-use-individual-access","2. Use individual access",[60,1492,1493],{},"Invite named users through the provider instead of sharing a single administrator password. Grant only the access needed, enable multi-factor authentication where available and record who can approve higher-risk actions.",[60,1495,1496],{},"Do not remove the outgoing provider until the new team has verified its own access and the organisation has confirmed the handover is complete.",[67,1498,1500],{"id":1499},"_3-collect-the-technical-record","3. Collect the technical record",[60,1502,1503],{},"Ask for:",[72,1505,1506,1509,1512,1515,1518,1521,1524,1527,1530,1533],{},[75,1507,1508],{},"architecture and hosting notes;",[75,1510,1511],{},"local, staging and production environments;",[75,1513,1514],{},"repository and branch workflow;",[75,1516,1517],{},"deployment and rollback steps;",[75,1519,1520],{},"database migrations and scheduled jobs;",[75,1522,1523],{},"third-party API details and webhook flows;",[75,1525,1526],{},"custom code and known technical debt;",[75,1528,1529],{},"critical customer journeys;",[75,1531,1532],{},"open defects and planned work;",[75,1534,1535],{},"incident and maintenance history.",[60,1537,1538],{},"Missing documentation is common. Mark it as a gap rather than pretending the knowledge exists.",[67,1540,1542],{"id":1541},"_4-preserve-a-known-baseline","4. Preserve a known baseline",[60,1544,1545],{},"Before the first broad update or configuration change:",[181,1547,1548,1551,1554,1557,1560,1563],{},[75,1549,1550],{},"Verify a complete backup or snapshot.",[75,1552,1553],{},"Confirm how restoration would work.",[75,1555,1556],{},"Record current versions and dependencies.",[75,1558,1559],{},"Export or preserve relevant configuration.",[75,1561,1562],{},"Tag or record the current production code state.",[75,1564,1565],{},"Capture the current behaviour of important journeys.",[60,1567,1568],{},"This baseline gives the new team something concrete to compare and, where possible, recover.",[67,1570,1572],{"id":1571},"_5-test-the-business-critical-journeys","5. Test the business-critical journeys",[60,1574,1575],{},"Do not limit takeover testing to “the home page loads.” Check the actions the organisation depends on:",[72,1577,1578,1581,1584,1587,1590,1593,1596,1599],{},[75,1579,1580],{},"enquiry forms and internal notifications;",[75,1582,1583],{},"checkout and payment confirmation;",[75,1585,1586],{},"registration, login and password reset;",[75,1588,1589],{},"search, filters and downloads;",[75,1591,1592],{},"editorial publishing;",[75,1594,1595],{},"CRM, email and external API flows;",[75,1597,1598],{},"analytics and consent behaviour;",[75,1600,1601],{},"scheduled imports, exports and background jobs.",[60,1603,1604],{},"Record the expected result and who confirms it.",[67,1606,1608],{"id":1607},"_6-review-support-lifecycle-and-risk","6. Review support lifecycle and risk",[60,1610,1611],{},"Identify the CMS or framework version, hosting runtime and important packages. Compare them with official support policies. For example, Laravel defines bug-fix and security-fix windows for framework releases, while Drupal Security Team coverage applies to supported Drupal versions.",[60,1613,1614],{},"Review abandoned extensions, expired licences, custom code and accounts belonging to former staff. These may become stabilisation tasks before routine maintenance.",[67,1616,1618],{"id":1617},"_7-rotate-access-deliberately","7. Rotate access deliberately",[60,1620,1621],{},"After the handover is verified, remove accounts that are no longer authorised and rotate shared secrets that cannot be replaced with individual access. Coordinate changes to API keys, webhook secrets and deployment tokens so working integrations are not broken unexpectedly.",[60,1623,1624],{},"Never publish secrets in tickets, chat transcripts or repository history.",[67,1626,1628],{"id":1627},"_8-agree-on-the-new-operating-rhythm","8. Agree on the new operating rhythm",[60,1630,1631],{},"Document:",[72,1633,1634,1637,1640,1643,1646,1649,1652],{},[75,1635,1636],{},"who owns business priorities;",[75,1638,1639],{},"who owns technical maintenance;",[75,1641,1642],{},"how routine and urgent requests are sent;",[75,1644,1645],{},"which checks occur weekly, monthly and quarterly;",[75,1647,1648],{},"what evidence or reporting is provided;",[75,1650,1651],{},"who coordinates hosting and third-party incidents;",[75,1653,1654],{},"what needs separate approval or quotation.",[67,1656,1658],{"id":1657},"the-handover-is-complete-when-continuity-is-real","The handover is complete when continuity is real",[60,1660,1661],{},"A takeover is not complete because the new provider has logged in once. It is complete when the organisation controls the key assets, the new team can deploy and recover safely, critical journeys have been checked, known gaps are documented and everyone understands what happens next.",[67,1663,215],{"id":214},[72,1665,1666,1671,1678,1683],{},[75,1667,1668],{},[221,1669,441],{"href":439,"rel":1670},[225],[75,1672,1673],{},[221,1674,1677],{"href":1675,"rel":1676},"https:\u002F\u002Fwww.drupal.org\u002Fdrupal-security-team\u002Fgeneral-information",[225],"Drupal Security Team: General information",[75,1679,1680],{},[221,1681,653],{"href":651,"rel":1682},[225],[75,1684,1685],{},[221,1686,838],{"href":836,"rel":1687},[225],{"title":10,"searchDepth":242,"depth":242,"links":1689},[1690,1691,1692,1693,1694,1695,1696,1697,1698,1699],{"id":1447,"depth":242,"text":1448},{"id":1489,"depth":242,"text":1490},{"id":1499,"depth":242,"text":1500},{"id":1541,"depth":242,"text":1542},{"id":1571,"depth":242,"text":1572},{"id":1607,"depth":242,"text":1608},{"id":1617,"depth":242,"text":1618},{"id":1627,"depth":242,"text":1628},{"id":1657,"depth":242,"text":1658},{"id":214,"depth":242,"text":215},"A structured website handover checklist covering ownership, access, backups, source code, integrations, testing and the first safe changes.",{},"\u002Farticles\u002Fsafely-take-over-existing-website","2026-08-01T15:55:00+08:00",{"title":1436,"description":1700},"articles\u002Fsafely-take-over-existing-website","website takeover checklist","J4O5gvjvUISu3JmfruGxeqn1d45-esx6-8gxgII8fuM",1785585065994]