Security of a dental clinic website

Rule number one: I never use photographs pulled from a Google search.
Rule number two: every illustration is purchased officially, through Shutterstock.

Buying proper licences allows me to use these photographs and videos in website design with a completely clear conscience.

This is perhaps the most painful subject of all for me. I've run into websites being copied several times myself. Early in my career, before I had any real connections or friends within the professional community, I published links to demonstration projects of the ready-made dental websites I'd created — and on three separate occasions, my projects were copied wholesale, everything taken. All three sites have since closed, of course, but it cost a great deal of time and no small amount of stress. And the clinic owners themselves weren't to blame in any of this — they'd simply commissioned a website, and whoever built theirs had simply found a good solution and helped themselves to it.

You need to understand that, technically, copying any website is trivially easy for a professional. That's precisely why you won't find links to my clients' live websites anywhere on this site — it's my own small contribution to their peace of mind. Genuinely comprehensive protection against copying is only really achievable with a solicitor's help.

Register the domain and hosting solely in your own name, using your own identification. Life is long, and there's no telling how someone will behave once a disagreement arises. There have been real cases where a client commissioned a website, only for it to be built on a domain and hosting account belonging to the developer. Seven years on, the client wanted a redesign, found a new developer — and the original one offered to sell the domain back at a price entirely of their own choosing.

Don't put yourself in a position where someone else gets to dictate the terms.

Register the domain and hosting solely in your own name.

And, importantly, make sure you list an email address you genuinely check. A year from now, you'll receive a notice about domain renewal, and you need to see it and act on it. There are plenty of cautionary tales of this notice being spotted too late — sometimes only after stumbling across an advert offering the domain for sale. You need to understand that there are people out there who actively hunt for expired, released domains. Their bots are set up so that the instant a domain becomes available, they snap it up and open negotiations to sell it back to you. So register the domain and hosting under your primary email address, the one you actually use.

The rule here is simple: change your passwords from time to time. Once your dental clinic's website is built and the development stage is finished, change the passwords. I'm sometimes called in to fix something on a clinic's website two or three years down the line, and in about half of those cases, the original passwords still work. I always remind clients that updating passwords regularly is simply good practice.

This one's straightforward: keep the list of staff with access as short as possible. Talk them through it, so they understand that access to the admin panel carries real responsibility. Naturally, once an employee leaves, their account should be closed straight away — this takes barely a minute for your website administrator to do.

Honestly, this isn't something you need to worry about — it's the developer's responsibility entirely. The one thing worth understanding is where your developer actually sources the modules installed on the site. If they're purchased officially, and your developer asks for payment towards their annual renewal and updates, that's a good sign — that's exactly how it should work. I don't charge my clients for website updates at all: I update the engine, the builder, and every module free of charge. That's only possible because most of the modules installed on my ready-made dental website projects were bought by me outright, at the highest tier, with lifetime updates included. My business model allows for this, and it's a genuine convenience for clients, whose sites can always be brought effortlessly up to date.

If modules and extensions are downloaded from third-party sites rather than purchased properly, the risk of malware appearing rises sharply. My own clients have run into this, and I've had to clean infected websites myself. It isn't always straightforward, but it is a solvable problem — if it happens to you, simply bring in a professional.

The main thing you need to know is simply this: use a long, complex password. Bots roam the internet constantly, guessing at passwords, and once one gains access, it posts whatever content it needs to onto the site.

Beyond simple password-guessing, hacking a modern, well-built site has become so difficult that it's fair to say all major engines are genuinely well protected these days.

There are, of course, further ways to harden a site's security, but I've never needed to reach for them — in more than eight years of work, and hundreds of websites built for dental clinics, not a single client has ever lost control of their site.

There have been two occasions where a client accidentally clicked "replace" instead of "add," and the information from an entire page vanished from the site. Because almost all my clients' sites are hosted with Reg.Ru, we were able to restore both at the click of a single button. Choosing the right hosting provider is an important decision, and I'm genuinely pleased with how their support team operates. Over the years, we've solved a great many complex problems together — blocking thousands of bot attacks, restoring sites, and dealing with virus infections. Most importantly of all, they take a full backup of the site every single night, which can be rolled back to with the click of one button whenever it's needed.

The single most important rule of security, for you as a website owner, has always been, and remains, proper password management. The technical safeguards built into modern platforms are genuinely strong. It's our own human weaknesses — forgetfulness, laziness, gullibility — that remain the weakest link in any website's security. The only realistic way for anyone to gain unauthorised access is by obtaining either the hosting (server) password or the site's admin password.

Store them somewhere secure, update them whenever you change contractor, and you're doing everything right — your site is safe.