Accountants and lawyers need hosting that treats the website as part of their confidentiality duty, not just a brochure. That means an up-to-date, isolated site with strong logins, encrypted connections, off-site backups and no sensitive client data passing through ordinary web forms or email. Your website is the front door criminals use to impersonate you, so it needs to be locked like one.
Key takeaways
- Professional firms hold exactly what criminals want: identity documents, tax details and money in motion.
- Your professional rules already expect confidentiality and, for Victorian lawyers, specific cyber controls.
- Keep sensitive documents out of contact forms and email. Use a proper client portal.
- Ask your host about isolation, firewalls, backups, Australian data centres and who keeps the site updated.
Why are accounting and law firm websites a target?
Because the payoff is high. A firm’s systems hold tax file numbers, ID documents, bank details and settlement funds. Criminals don’t need to break into everything. A hacked website or a convincing fake email can be enough to redirect a payment.
That fraud is costly. The ACCC reports Australians lost $166.8 million to payment redirection scams in 2025, out of $2.18 billion in total scam losses (ACCC). Breaches are common too. The OAIC received 81 data breach notifications from legal, accounting and management services in 2025, the sixth-highest sector (OAIC).
What do your professional rules expect?
For tax and BAS agents, the Tax Practitioners Board’s Code is clear: “you must not disclose any information relating to a client’s affairs to a third party without your client’s permission”, unless you have a legal duty to (Tax Practitioners Board). A breach caused by weak systems is still a disclosure your clients didn’t agree to.
Lawyers have a confidentiality duty under the conduct rules. In Victoria, the Legal Services Board + Commissioner goes further with Minimum Cybersecurity Expectations. It lists failing to install security updates and failing to turn on multi-factor authentication as conduct capable of being unsatisfactory professional conduct or professional misconduct (VLSB+C). Your website software is software, so those expectations reach it.
Check your own regulator and professional body for the rules that apply to you.
What should your website do, and not do?
Keep sensitive documents out of web forms and email
A standard contact form usually sends its contents by ordinary email. That’s fine for “please call me”. It’s not fine for tax returns, payslips or driver’s licences. The VLSB+C says unencrypted channels like email should carry high-risk information only at a client’s request and only if strictly necessary. Use a secure client portal for documents, and say so on your contact page.
Never run software nobody maintains
The same guidance says not to run software “no longer updated or maintained by the developer”. On a WordPress site, that means abandoned plugins and old themes. Every plugin should be current and still supported.
Lock down the logins
Every admin account needs a unique password and two-factor login. Remove accounts for staff and old developers who have left. A WordPress firewall blocks password-guessing and known attacks before they reach the login page.
Help clients spot fakes
Don’t publish bank details on your website. Instead, tell clients you will never change payment details by email, and that they should phone you on a known number to confirm. The VLSB+C expects firms to verify payment details by phone, video or in person. Set up SPF, DKIM and DMARC so criminals find it harder to send email that looks like it came from your domain.
What should you ask your hosting provider?
| Ask | Why it matters to a firm |
|---|---|
| Where is my site and its data stored? | You stay accountable for personal information sent offshore |
| Is my site isolated from other customers? | A neighbour’s hack shouldn’t become yours |
| Is there a firewall and malware scanning? | Stops common attacks and spots infections early |
| How are backups stored and tested? | Off-site, encrypted copies you can restore quickly |
| Who updates the website software? | Most hosts look after the server, not your plugins |
| Can I phone someone in an emergency? | A breach needs a fast, local response |
Isolation is the one cheap plans often skip. Our article on shared hosting security explains the risk of sharing a server with hacked sites. Busy firms should also watch for bot traffic on a website, which can hammer login pages and slow everything down.
On backups, the VLSB+C asks law practices to back up at least once a fortnight, keep backups encrypted and away from the main system, and test a restore at least once a year. That’s a sensible floor for any firm.
Who keeps the website itself safe?
This is a common gap. A firm buys good hosting and assumes the website is covered. It usually isn’t. The host runs the server, while plugins, themes, users and forms are the website owner’s job.
Our website security monitoring covers that side. Maintain & Protect includes a security audit and lockdown at setup, firewall and login protection, malware and vulnerability scanning, updates and off-site backups. Advantage adds two-factor login and repairs if an update breaks something.
How does WMS hosting fit?
Our secure web hosting runs in NEXTDC data centres in Brisbane and Melbourne. Every plan includes free SSL and free migration, backed by a 99.9% uptime SLA.
Most firms suit a Business plan, from $98 a month + GST, which adds phone support 7 days, 9 to 5. Firms wanting their own server can choose a VPS. Compare our hosting plans or build your own in the plan builder.
Frequently asked questions
Do accountants have to host their website in Australia?
There’s no general law requiring a private firm’s website to be hosted in Australia. But under the Privacy Act, you can remain accountable for how an overseas provider handles personal information you send offshore. Local hosting keeps that simpler and is easier to explain to clients who ask.
Is it safe to collect tax file numbers through a website form?
Not with an ordinary contact form. Most forms email their contents and may also store them in the website database, where a hack could expose them. Use a secure client portal or document exchange built for the purpose, and keep the website form for enquiries only.
Should my law firm’s website show our trust account details?
No. Published bank details make it easier for criminals to build convincing fake invoices and change-of-details emails. Give payment details through a verified channel, and tell clients on your website that you’ll never change them by email alone.
Does the Privacy Act apply to a small accounting practice?
Often, yes, even under the $3 million turnover threshold. Tax file number recipients are covered by the Notifiable Data Breaches scheme for the TFN information they hold, whatever their size. Check the OAIC’s guidance or get advice for your situation.
Is WordPress secure enough for a professional firm?
Yes, when it’s maintained properly. Most WordPress security holes are found in plugins, not WordPress itself. Keep the site lean, updated and monitored, use two-factor login, and keep sensitive client documents in a dedicated portal rather than the website.
Sources
- Continued action critical to combat fraud as annual scam losses exceed $2 billion, ACCC, 30 March 2026
- Data breach notifications increase to all-time high in 2025, OAIC
- Code obligations, Tax Practitioners Board, accessed 13 November 2026
- Minimum Cybersecurity Expectations: Guidance for Law Practices, Victorian Legal Services Board + Commissioner, February 2024