The Website Security Checklist UAE Businesses Should Actually Ask For

Security questions rarely come up during hiring — they come up after something's already gone wrong. That's backwards. Here's what's worth confirming before a developer ever touches production, not after.

Who actually owns the credentials

Domain registrar, hosting account, admin logins — these should be registered in the client's name and shared with the developer, not the other way around. If a developer resists handing over ownership of accounts they set up on your behalf, that's worth asking about directly before the relationship goes any further.

Backups that are actually tested, not just scheduled

A lot of businesses discover their backups were silently broken only at the exact moment they need one. A scheduled backup that's never been restored is a false sense of security. Ask when a restore was last actually tested, not just when the last backup ran.

Update hygiene, especially on WordPress

Since most real estate marketing sites run on WordPress, outdated plugins and themes are the single largest attack surface most businesses have. Core, themes and plugins should be kept current, and anything unused should be removed rather than left installed and forgotten.

SSL, forms, and where the data actually goes

A padlock icon isn't the whole story. Inquiry forms on a real estate site collect names, phone numbers, emails and sometimes budgets — that data should move over HTTPS and land somewhere secure, not get quietly logged in plaintext or forwarded to an unsecured inbox.

What this looks like on my projects

Client-owned hosting and domains, dependencies kept current, HTTPS across every site I build, and inquiry data wired to endpoints the client actually controls. None of this is exotic — it's just the baseline I hold every project to.