Website security for Iranian businesses: the essentials

Iranian business sites have a minimum: HTTPS, roles that are not everyone-as-admin, form validation, upload limits, scheduled backups, and failed-login logs. WordPress means plugin updates and no user named admin. Laravel means hiding env and updating the framework. KGSM on kgsm.ir locks this in web programming from sprint one. A look from web design is not security. HTTPS is also non-negotiable in SEO. For a review, send the site type via contact.

This guide — Website security for Iranian businesses: the essentials — is written from KGSM delivery work: scoped first versions, staged releases, and support after handoff.

Audience, risk, and how KGSM works

An Iranian business owner with a site or shop who wants security minimums before a breach, not after ransomware

Weak passwords, old plugins, unlimited forms, and untested backups mean sales stop, customer data leaks, and recovery costs more than the build.

KGSM builds security into web development from day one: HTTPS, roles, backups, and limited forms — not a plugin after a hack.

HTTPS, roles, and passwords: the login minimum

Force SSL on the whole domain and redirect HTTP. Session cookies should be Secure and HttpOnly so page scripts cannot steal them. A user named admin or the password 1234 is still the most common way into Iranian panels. Split roles on day one: editor, read-only finance, limited admin. Log failed logins and add a short lock after several tries. If the panel lives at a guessable /admin, change the path — but that does not replace a strong password. KGSM treats these as a web-programming handoff checklist. Two-factor for a shop admin is worth it. Invalidate sessions after a password change. Do not send passwords in WhatsApp; the manager has a separate secret. When a staff member leaves, close access the same day.

Do not create a user named admin; change the default password the same day. The admin password lived in a chat group and the homepage changed after an intern left.

Harden WordPress and Laravel differently

On WordPress, update plugins and themes from known sources and delete abandoned plugins. Do not create a user named admin. Turn off in-dashboard file editing if you do not need it. On Laravel, keep env off the web root, disable debug in production, and put framework updates in maintenance — not «when we have time». Limit uploads by type and size; php inside an images folder is a classic. Do not skip CSRF and input validation to speed up a demo. If the shop is custom, KGSM builds Laravel with roles and logs so a random plugin does not grow the attack surface. A pretty theme from web design is still vulnerable on stale WordPress. Hiding the software version helps only a little; updates are the real work.

An abandoned plugin opened the form; monthly updates were not in the contract. Redirect HTTP to HTTPS and clear mixed content.

Forms, spam, and the public attack surface

A contact form with no rate limit invites bots and brute force. Rate limits, a light captcha, and a honeypot are enough for humans. Keep messages in a panel or a company inbox, not a personal mailbox that vanishes with a phone. Rate-limit search and login too. If you take payments, sign the return page and read the amount from the server, not from a hidden browser field. KGSM writes this in shop discovery because a patch after a fake transaction is expensive. Do not store backups on the same public server. Disable directory listing. Add basic security headers after HTTPS — no unexpected iframe, no mixed content. SEO without HTTPS breaks both user trust and the browser.

Give finance a read-only role. The env file was web-accessible and the gateway key leaked.

Backups, restore, and a maintenance contract

A backup without a restore test is a comforting file, not a plan. Practice a restore on staging once a week. Keep copies off the web server. After a breach, deleting one suspicious file is not enough; change passwords, invalidate sessions, and read access history. KGSM puts a security-fix window and updates in the contract so a verbal promise does not die when the first person leaves. If you have no maintenance budget, say so before the build so the architecture stays simple with fewer plugins. Keep domain, host, and Console on the company account. For a security review, tell contact whether you are on WordPress or Laravel and whether you take payments. Write a dated incident note with the action taken. Security is never complete; it is operable.

Backups sat on the same host and were wiped with the site by ransomware. Log failed logins and add a short lockout.

Put plugin and framework updates in the maintenance contract. An unlimited form created thousands of emails and filled the server.

A contractor put a php file in the uploads folder over FTP. Keep backups off the web server and test a restore.

Rate-limit the form and add a light captcha. The admin password lived in a chat group and the homepage changed after an intern left.

An abandoned plugin opened the form; monthly updates were not in the contract. Revoke a departed staff member’s access the same day.

Implementation checklist

• Do not create a user named admin; change the default password the same day.
• Redirect HTTP to HTTPS and clear mixed content.
• Give finance a read-only role.
• Log failed logins and add a short lockout.
• Put plugin and framework updates in the maintenance contract.
• Keep backups off the web server and test a restore.
• Rate-limit the form and add a light captcha.
• Revoke a departed staff member’s access the same day.

Field scenario 1

The admin password lived in a chat group and the homepage changed after an intern left.

Do not create a user named admin; change the default password the same day.

Field scenario 2

An abandoned plugin opened the form; monthly updates were not in the contract.

Redirect HTTP to HTTPS and clear mixed content.

Field scenario 3

The env file was web-accessible and the gateway key leaked.

Give finance a read-only role.

Field scenario 4

Backups sat on the same host and were wiped with the site by ransomware.

Log failed logins and add a short lockout.

Field scenario 5

An unlimited form created thousands of emails and filled the server.

Put plugin and framework updates in the maintenance contract.

Field scenario 6

A contractor put a php file in the uploads folder over FTP.

Keep backups off the web server and test a restore.

Related KGSM pages

Continue with KGSM services: سئو و بهینه‌سازی, برنامه‌نویسی و توسعه نرم‌افزار. Related reading: چک‌لیست امنیت Laravel برای سامانه سازمانی. For a scoped estimate, use the contact form.

When you apply this on a live team, write it as an operating rule, not a slide: Do not create a user named admin; change the default password the same day. Then assign an owner and a review date so the rule survives the first busy week.

When you apply this on a live team, write it as an operating rule, not a slide: Redirect HTTP to HTTPS and clear mixed content. Then assign an owner and a review date so the rule survives the first busy week.

When you apply this on a live team, write it as an operating rule, not a slide: Give finance a read-only role. Then assign an owner and a review date so the rule survives the first busy week.

When you apply this on a live team, write it as an operating rule, not a slide: Log failed logins and add a short lockout. Then assign an owner and a review date so the rule survives the first busy week.

When you apply this on a live team, write it as an operating rule, not a slide: Put plugin and framework updates in the maintenance contract. Then assign an owner and a review date so the rule survives the first busy week.

When you apply this on a live team, write it as an operating rule, not a slide: Keep backups off the web server and test a restore. Then assign an owner and a review date so the rule survives the first busy week.

When you apply this on a live team, write it as an operating rule, not a slide: Rate-limit the form and add a light captcha. Then assign an owner and a review date so the rule survives the first busy week.

When you apply this on a live team, write it as an operating rule, not a slide: Revoke a departed staff member’s access the same day. Then assign an owner and a review date so the rule survives the first busy week.

When you apply this on a live team, write it as an operating rule, not a slide: The admin password lived in a chat group and the homepage changed after an intern left. Then assign an owner and a review date so the rule survives the first busy week.