Prepare a website security incident response plan by writing a leadership-approved document that assigns roles, backup steps, and communication steps before an attack. Test offline backups and rehearse the plan with tabletop exercises so staff know duties and escalation. An incident response plan is that written playbook for suspected or confirmed website attacks. For WordPress, Drupal, and marketing sites, it connects developers, hosts, project managers, and clients in one clear workflow.
Table of Contents
- What should the written plan cover?
- Who does what before an attack?
- How do you keep backups and communications usable?
- What happens during containment and notification?
What should the written plan cover?
CISA defines an incident response plan as a written document approved by senior leadership that guides the organization before, during, and after a confirmed or suspected incident, as explained in CISA incident response plan basics. Get that approval in writing and store the plan where the team can find it during an outage. NIST published SP 800-61 Rev. 3 in April 2025, replacing Rev.
2 from 2012, mapping response across CSF 2.0 functions Govern, Identify, Protect, Detect, Respond and Recover, according to NIST incident handling guidance. Use those six functions as your table of contents. For a website, translate the model into site tasks. List domains, hosting accounts, DNS, CMS admin paths, plugins, payment forms, and log locations. Add contact details, escalation thresholds, and criteria for taking the site offline.
Who does what before an attack?
CISA tells small businesses to assign incident roles in advance and run tabletop exercises so every participant understands duties, escalation, and communications, as described in CISA guidance for small businesses. Schedule a one-hour walkthrough with developers, support, and marketing before launch season.
The FTC instructs businesses to mobilize a breach team immediately, potentially including forensics, legal, information security, IT, operations, HR, communications, and investor relations. A small agency can map the same seats to fewer people.
- Lead: declares incident, calls host and legal counsel
- Technical: revokes sessions, blocks attacker IPs, preserves logs
- Communications: drafts client and visitor notices, pauses ads
How do you keep backups and communications usable?
CISA directs organizations to maintain offline, encrypted backups of critical data and regularly test backup availability and integrity in a disaster-recovery scenario, as stated in the CISA StopRansomware guide. Keep one database plus files copy off the host network. Restore it to a staging subdomain each quarter.
The same CISA guide directs organizations to create, maintain, and regularly exercise a basic response plan plus a communications plan covering ransomware and data extortion, with hard-copy and offline versions. Print call trees, host ticket logins, registrar codes, and ad account contacts. Test both pieces together. If the CMS admin is locked, the team should still reach the host by phone, pull the clean backup, and post status without site email.
What happens during containment and notification?
The FTC instructs businesses to quickly secure systems, fix exploited vulnerabilities, and preserve evidence before cleanup. Clone logs, snapshot the infected site, then patch the theme, plugin, or password that allowed entry. Then notify law enforcement, affected businesses, and individuals as appropriate.
State breach-notification laws vary, so legal review is required before you send notices or set deadlines. For client sites, confirm who notifies customers, who contacts the payment processor, and who documents costs and timelines. Keep printed copies of the plan and contacts outside the compromised system.
