B2B website security baseline
A marketing-site threat model you can fill: assets, identities, secrets, forms, dependencies, backups, and a named restore test.
One owner per row. If everyone owns secrets, nobody does. Walk it before launch and after any plugin or form change.
This is a baseline for a brochure or lead-gen site, not a bank. Escalations (pentest, bug bounty) sit outside this card.
flowchart TD
A["Assets"] --> I["Identities"]
I --> S["Secrets"]
S --> F["Forms"]
F --> D["Dependencies"]
D --> B["Backup plus restore"]
Assets
- Registrar, DNS host, and certificate owner named
- CMS or git repo URL listed; staging is not production
- Every public form URL listed with where the payload goes
- Object storage / CDN bucket named
Identities and roles
- Admin seats counted. Fewer than you think you need.
- Leavers removed from CMS, git, DNS, analytics, ads
- No shared “marketing@” password in a slide deck
- Multi-factor authentication (MFA) on registrar, DNS, CMS, git, email
Secrets
- No API keys in the public repo or client JavaScript
- Production secrets live in the host secret store, not a Notion page
- Rotation owner named for form keys, CMS keys, analytics
Forms
- Forms post only over HTTPS to an origin you control
- Bot filter that is not “please wait 0ms”
- File uploads off unless you have a scanned store. Default is no.
- Failure still stores or retries. A 500 is not a silent lead death.
Backup and restore
- What is backed up: git, CMS export, DNS zone, form archive
- Last restore test date (a real restore, not a screenshot of a backup job)
- Who is awake if the site 500s on a Monday