Security basics every publishing team should lock down

Content sites are a favorite target: they are public, cached, and often neglected. Lock down the basics.

Access

• Unique, long password for the admin account — never reused.
• HTTPS only, with HTTP redirected. HSTS once you are confident.
• Sign out of shared machines; sessions expire after two hours by default.

Platform

• Keep the framework and dependencies current.
• Never run the app as root; the web server user needs write access only to storage and bootstrap/cache.
• Turn off debug output in production.

Content

• Strip unsafe HTML from post bodies — the Markdown renderer does this by default.
• Validate every upload by MIME type, not just extension.
• Back up the database daily; test a restore quarterly.

None of this is glamorous. All of it is cheap insurance.