Website Security Basics Every Law Firm Should Have (Without an IT Department)

22 September 2026·5 min read

Quick answer: Website security for a law firm doesn't need an IT department — it needs someone to know who holds the keys, checked on a schedule instead of assumed. That means real automated backups, 2FA on every login that matters, a clear answer to "who can access our domain registrar," and someone actually applying plugin updates. Most firms get hit by neglect, not sophisticated hackers. 🚀

Here's the uncomfortable truth about most law firm websites: nobody actually owns security for it. It was built by a developer years ago and has just sat there since, quietly assumed to be "someone else's problem." That works fine right up until your homepage is replaced with something unspeakable overnight, or a client rings asking why "your firm" emailed them new trust account details. We've watched this play out with real practices, and the fix is almost always cheaper than the panic suggests — but only if someone owns it before the bad day. That's what this checklist is for, and honestly, sorting it is a satisfying admin win 💖.

What most law firms get wrong about website security

The pattern is nearly identical everywhere: security gets treated as a one-off task "handled" at launch, not an ongoing job with a name attached. Ask a partner who has admin access and you'll get a shrug, or the name of someone who left two years ago. This isn't carelessness — security sits in a gap between "IT stuff" and "marketing stuff," and both sides assume the other has it covered. The stakes are higher than most small businesses too: you're often protecting an enquiry form capturing matter details from people in genuinely vulnerable situations. A compromised site doesn't just look bad — it undermines the thing your business is built on: trust.

The 5-minute security audit (copy this and actually do it)

Block out five minutes, grab whoever manages your website, and go through this in order — you're checking yes/no, not writing a policy document.

Backups: Are automated backups switched on right now, and do you know where to find them? "The developer probably backs it up" is not an answer — confirm it today.
2FA: Is two-factor authentication on for your website admin, domain registrar, hosting, and the email tied to all of them? All four, not just one.
Domain access: Do you know which email and login controls your domain, and can someone at the firm — not just a contractor — get into it if needed?
Plugin updates: Is your CMS and its plugins actually being kept up to date, and by whom? "I don't know" is your answer.
Staff phishing awareness: Would reception recognise a fake "urgent trust account update" email? Have they ever seen a real example?

Less than five out of five is completely normal — and now you know exactly where to start.

The overnight defacement: A small family law firm came in one Monday to find their homepage replaced with spam, through a plugin nobody had updated in over a year. No proper backup meant a full rebuild — a week of downtime while enquiries went to competitors. The fix took under an hour once started. The lost week is what actually hurt.

The forgotten domain: A solo conveyancing practice nearly lost its domain when the registrar login turned out to belong to a staff member who'd left eighteen months earlier and wasn't answering calls. It was days from lapsing before anyone found it, sorted only through a slow identity-verification process. A conveyancer without a website mid-settlement season is not a good look.

How to actually do this (plain English, no jargon)

2FA: in each account's security settings — website admin, registrar, hosting, email — find "two-factor authentication" and link it to an authenticator app or text code. Adds seconds to logging in, stops most account takeovers dead.

Domain ownership: your domain sits with a registrar, separate from your host. Find your renewal receipt, confirm which email is the account holder, and make sure it's a firm-controlled inbox, not a personal Gmail or an ex-employee's.

Real backups: most hosts have a backup feature, often off by default. Turn on automatic backups in your dashboard, then confirm a recent file actually exists rather than trusting the toggle.

Access review: check "users" in your website admin and remove anyone who no longer works at the firm, every time someone leaves.

💡 Your website is firm infrastructure, not a marketing decoration. Treat access to it like access to your trust account — to a scammer, it's often the easiest door in.

Mistakes to avoid

Assuming "the developer handles backups" without confirming a backup file actually exists.
One shared admin login for the whole team instead of individual logins you can switch off.
Registering the domain under a staff member's personal email instead of a firm-controlled account.
Ignoring update notifications because "it's working fine right now."
Never briefing reception on what a spoofed "urgent" email from the firm might look like.

Please note: general information, not legal or compliance advice — check current official guidance before relying on it, and confirm specific requirements with your practice's IT or compliance adviser given the privileged and confidential client data your firm holds.

Frequently asked questions

Do I need a dedicated IT person for this?

No — most of what protects a small firm's website is account hygiene: backups, 2FA, and knowing who has access. That said, if your firm handles particularly high-value matters or stores sensitive documents on the website itself, it's worth a chat with an IT or compliance adviser about whether you need more than the basics.

What's the first thing to do if I think the site's been hacked?

Take it offline or into maintenance mode if you can, change passwords on hosting, registrar, and admin immediately, and contact your host or developer. Check whether you have a clean recent backup to restore from. Don't quietly fix it and hope nobody noticed — if client data may have been exposed, that needs proper assessment, not a guess.

Is a checklist like this actually enough?

For most small to mid-sized firms, working through it regularly closes off the vast majority of realistic risks. But it's not a substitute for a proper security audit if you handle particularly sensitive matters or have had an incident before — get a specialist in.

Who should "own" this at a small firm?

Ideally one named person — often the practice manager — who runs the checklist quarterly and is the point of contact when staff join or leave. It doesn't need to be a technical role, just a defined one.

Keep reading 🤍

Written by

Kate, founder of Chronically Online

I help Gold Coast and Brisbane businesses grow with branding, websites and marketing that actually works.

Work with me ✦