Protect a site during a CMS migration, a move between content management systems, with backup, staging, tight logins, and hardening. Add HTTPS-only delivery, mapped redirects, patched code, and active monitoring to finish safely.
Migration opens brief gaps. Files move, logins change, and addresses change. Attackers probe those moments for mistakes.
Official resources:
- Follow the official WordPress hardening checklist for backups, passwords, and file permissions — Verify backup, password, file-permission, and logging steps directly in the source hardening guide.
- Use Google’s site-move guide to stage, test, and redirect CMS URL changes — Check how to test the new site first and map old URLs to 301 redirects.
Table of Contents
- Back Up and Stage Before You Touch Production?
- Who Can Log In During the Move?
- How Do You Harden the New CMS?
- How Do You Keep Connections and URLs Safe?
- What Needs Patching and Watching After Launch?
Back Up and Stage Before You Touch Production?
Make a full copy of files plus database before you start. WordPress recommends a complete backup you can restore in its hardening guide. Test the restore on a separate host before migration day.
Build the new CMS on an isolated staging copy. Google advises testing there first and changing only one major thing at a time in its site-move guide. Joint domain, platform, and layout moves multiply failures.
- Save backup offline from production
- Confirm restore works
- Freeze content edits during transfer
Who Can Log In During the Move?
Re-issue admin credentials on migration day. Give each person only the role needed for the task. CISA urges phishing-resistant MFA such as FIDO2/WebAuthn in its multifactor authentication guidance.
A stolen password alone then cannot open admin tools. Remove old staff and vendor accounts before transfer. Disable temporary migration accounts right after import. Keep one offline owner account for emergency recovery.
How Do You Harden the New CMS?
Lock down file permissions on the new system. Protect wp-config.php, restrict wp-admin, and turn off dashboard file editing. WordPress lists these limits as core hardening steps.
Leave dashboard editing off even when it feels faster. Change code through version control and file access instead. Re-check permissions after every plugin or theme install.
How Do You Keep Connections and URLs Safe?
Serve the moved site HTTPS-only with HSTS. CISA directs agencies to disable SSLv2, SSLv3, and weak ciphers such as 3DES and RC4. Fix mixed content and redirect loops before launch.
Map every old URL to its new counterpart. Google advises server-side permanent 301 or 308 redirects kept as long as possible. Visitors and crawlers then reach secure pages, not dead ends.
What Needs Patching and Watching After Launch?
Update core and delete unused plugins and themes. Scan for misconfiguration and vulnerable parts. OWASP ranks broken access control, misconfiguration, and vulnerable components among top web risks in its Top 10 list.
Turn on logging for logins, file changes, and traffic. WordPress treats logging and monitoring as core hardening work. Watch both old and new URLs for weeks, since backups and redirects cannot catch active attacks. Keep login alerts and file-change alerts on past launch day.
