Four of the Essential Eight apply directly to a small business website: patching, multi-factor authentication, limiting admin access and regular backups. A fifth, patching operating systems, applies to your server and is usually your host’s job. The other three are written for office computers, so they matter for your business but not for the website itself. This guide maps each control to your site and says who should own it.
Key takeaways
- The Essential Eight is ASD’s core set of security controls, written for business IT networks rather than websites.
- Patching, two-factor logins, fewer admin accounts and tested backups are the four controls that protect a website most.
- For internet-facing services, ASD’s first maturity level expects critical patches within 48 hours.
- Your host should handle the server’s operating system. Ask them to confirm it in writing.
What is the Essential Eight?
The Essential Eight is a set of eight security controls from the Australian Signals Directorate (ASD). ASD describes them as the most effective of its wider strategies to mitigate cyber security incidents (ASD, Essential Eight explained). The eight are:
- patch applications
- patch operating systems
- multi-factor authentication
- restrict administrative privileges
- application control
- restrict Microsoft Office macros
- user application hardening
- regular backups
ASD says the model was designed to protect internet-connected information technology networks. In practice that means staff computers, servers and office software. A website is part of that picture, but only some controls fit it.
Why should a small business care?
Because small businesses get hit. The ABS found that 21% of Australian businesses had a cyber security incident in 2024–25, and 28% had no preventive measures in place (ABS). auDA’s 2026 research found 38% of small businesses think they’re too small to be targeted (auDA).
Websites are an easy way in. Patchstack recorded 11,334 new WordPress vulnerabilities in 2025, and 91% were in plugins (Patchstack). For the wider business picture, see our guide to small business cyber security in Australia.
Which Essential Eight controls apply to a website?
| Control | Applies to your website? | Who usually owns it |
|---|---|---|
| Patch applications | Yes: WordPress, plugins and themes | You or your maintenance provider |
| Patch operating systems | Yes: the web server | Your host |
| Multi-factor authentication | Yes: site, hosting, domain and email logins | You, set up by your provider |
| Restrict admin privileges | Yes: WordPress user roles | You |
| Application control | Partly: the idea, not the method | Your provider |
| Office macros | No: office computers only | Your IT support |
| User application hardening | No: web browsers on staff computers | Your IT support |
| Regular backups | Yes: files and database | Your host or maintenance provider |
Patch applications: what does it mean for WordPress?
For a website, the “applications” are WordPress itself, your theme and every plugin. This is the control that matters most, because most website hacks start with an out-of-date plugin.
ASD’s maturity model sets the pace. At Maturity Level One, patches for online services should be applied within 48 hours when a flaw is critical or already being exploited, and within two weeks otherwise. Online services that are no longer supported should be removed (ASD, Essential Eight maturity model). A website and its plugins fit that description.
Forty-eight hours is tight if nobody is watching. Patchstack found heavily exploited WordPress flaws were mass-exploited within a median of 5 hours. Our guide to a WordPress plugin vulnerability alert covers what to do when one hits the news.
Patch operating systems: is that my host’s job?
Usually, yes. The web server runs an operating system, often Linux, plus software such as PHP and the database. On shared and managed hosting you can’t reach these, so the host must patch them. On an unmanaged VPS, it may be your job.
Ask your host who patches the server and how fast. Good secure web hosting should also isolate accounts, so one hacked site on the server can’t reach yours.
Multi-factor authentication: which logins need it?
Turn on multi-factor authentication (MFA) wherever someone could take over your website. That means the WordPress admin, your hosting control panel, your domain registrar account and the email inbox that receives password resets.
WordPress doesn’t include two-factor login out of the box, so it needs a security plugin or your care provider to add it. auDA found that small businesses who think they’re too small to be targeted are less likely to use MFA (38%, against 57%).
The maturity model also expects MFA for customers where an online service holds sensitive customer data. If customers log in to your site to see orders or records, consider offering it.
Restrict admin privileges: how many admins is too many?
Every administrator account is a key to the whole site. In our experience, small business sites often carry admin logins for former staff, old developers and agencies nobody has used in years.
- Give staff the lowest WordPress role that lets them do their job, such as Editor or Shop Manager.
- Keep administrator accounts to the people who truly need them.
- Remove accounts for anyone who has left, and change shared passwords.
- Give contractors their own login, and remove it when the job ends.
What about application control, macros and browser hardening?
These three are aimed at staff computers. Application control stops unapproved programs running on workstations. Macro rules block harmful Microsoft Office files. Application hardening locks down web browsers. None of them is a website setting.
The idea behind application control still helps a website, though. Only install plugins from trusted sources, remove ones you don’t use, and turn off file editing in the WordPress dashboard. Keep the office side with whoever looks after your computers.
Regular backups: what does the model expect?
At Maturity Level One, backups of data, applications and settings should be kept according to how critical they are. They should be synchronised so everything restores to a common point in time, stored securely and tested as part of disaster recovery exercises.
For a website, that means the files and the database backed up together, kept off the web server and restored for real now and then. A backup that has never been restored is untested, and ASD’s model asks for testing.
Where should a small business start?
ASD advises reaching the same maturity level across all eight controls before aiming higher. For a website, start with this short list:
- Check for updates today. Update WordPress, the theme and plugins, and delete anything unused.
- Turn on MFA. Start with hosting, domain and email, then the WordPress admin.
- Audit your users. Remove old admin accounts and lower roles where you can.
- Confirm your backups. Ask where they’re stored, how long they’re kept and when one was last restored.
- Get a baseline. A website security scan shows obvious problems, though free scans miss a lot.
Then decide who keeps it going. Our website security monitoring covers updates, firewall and login protection, malware scanning and off-site backups. It’s included in all our website maintenance plans, with two-factor login added on Advantage.
Frequently asked questions
Is the Essential Eight mandatory for small businesses?
No. Private small businesses aren’t legally required to follow it. Some government contracts and larger customers may ask suppliers to meet a maturity level, so check any tender or contract terms. Even when it’s optional, it’s a sensible, free checklist from ASD that shows where to put limited time and money.
What maturity level should a small business aim for?
Maturity Level One is the usual starting point. ASD says it targets attackers using common, widely available tools, which is what most small business websites face. Reach Level One across all eight controls first, as ASD recommends, before aiming for Level Two in any single area.
Does my web host cover the Essential Eight for me?
Only part of it. A good host patches the server’s operating system and may keep backups. It usually doesn’t update your WordPress plugins, manage your user accounts or turn on two-factor login for your site. Those need you, or a website care provider, to own them.
Does the Essential Eight cover website security completely?
No. It covers ASD’s most effective strategies, not all of them, and ASD points to further strategies beyond the eight. A website also needs a firewall, malware scanning, SSL and monitoring for blacklisting. Treat the Essential Eight as the starting point, then add website protections on top.
How do I check if my plugins are up to date?
Log in to WordPress and open Dashboard, then Updates. It lists WordPress, plugin and theme updates waiting to be installed. Back up first, update in small batches and test your forms and checkout afterwards. Premium plugins may need a current licence before they will update.
Sources
- Essential Eight explained, Australian Signals Directorate, November 2023
- Essential Eight maturity model, Australian Signals Directorate, November 2023
- Characteristics of Australian Business, 2024–25, Australian Bureau of Statistics, June 2026
- Digital Lives of Australians 2026, auDA
- State of WordPress Security in 2026, Patchstack, accessed 13 November 2026