Websites & support / Explainer
HTTPS protects the connection. Your website still needs looking after.
A WordPress website can load over HTTPS and still have an account with too much access or a backup nobody has checked. Those are separate parts of looking after the site.
When we discuss website care, I want the explanation to say which part each service covers. A certificate is useful, and the owner also needs to know who handles the application and the records it holds.
Start with what the connection protects
HTTPS uses TLS to encrypt communication between the client and server. For an ordinary website visitor, that client is usually the browser. MDN’s HTTPS guide describes this protection of the communication.
A certificate is part of establishing that connection. Let’s Encrypt, for example, checks control of a domain before issuing a certificate for it. Its validation process concerns the domain; it does not inspect your WordPress users or the way a plugin handles a customer record.
Keep HTTPS working across the website and ask the person responsible to investigate certificate warnings. Bypassing a browser warning is a poor way to make an enquiry or a login work.
Source: MDN: HTTPS; Let’s Encrypt: certificate issuance and domain validation
Give the application its own maintenance plan
WordPress, the installed theme and plugins have their own update and maintenance needs. The official WordPress hardening guidance treats security as ongoing risk reduction, with attention to software, access and recovery.
For a fictional service website, the certificate might renew through the hosting arrangement while someone else manages WordPress updates. Write both responsibilities down, including what happens when an update needs testing before release.
The same applies to accounts. Give people access suitable for the work they do, review access when that work changes and agree who handles a suspected account problem. An encrypted connection does not decide who should be allowed to edit the website.
Source: WordPress: hardening guidance
Ask for a clear answer to each of these jobs
An owner should be able to find the person responsible without having to understand every hosting setting. I would start with the jobs below and ask what is included in the existing agreement.
| Job | Useful question for the owner |
|---|---|
| HTTPS and renewal | Who monitors it and handles a failed renewal? |
| Website software | Who reviews and tests the required updates? |
| Account access | Who approves access and removes it when no longer needed? |
| Backup and recovery | Which files and records are covered, and who tests a restoration? |
| A suspected incident | Which support route should we use and who investigates? |
Check the arrangement you have today
Collect the current hosting and maintenance details, then look for a named owner beside each job. If the scope is unclear, ask for it to be explained before assuming the job is covered.
We can use that record to discuss what your website needs. Start with the actual setup and the work the business relies on, then agree the ongoing care and the checks you should expect to see.
Sources
Checked on 23 October 2026.
- MDN: HTTPS
HTTPS uses TLS to encrypt communication between a client and a server.
- Let’s Encrypt: certificate issuance and domain validation
The certificate process checks control of a domain before issuance; it is separate from the website’s application maintenance.
- WordPress: hardening guidance
Ongoing risk reduction through appropriate software, access, hosting and backup arrangements.