A request goes to the wrong inbox
Quote forms may send to regional offices, estimators or an external CRM. Unreviewed recipient changes can divert requests or leave them unanswered. Establish who owns each route and approves changes.
Website security for construction
Keep your next project enquiry on track.
Protect quote requests, project portfolios and document handoffs with website security built around how your construction business wins work.
Small website changes can create expensive confusion.
A potential client may use your website to shortlist a contractor, check completed projects and request a quote. An altered contact route or unexpectedly public document can interrupt that process before your estimating team knows anything is wrong.
A portfolio publishes too much
Project photographs and downloadable brochures help demonstrate experience. Publishing access also needs a clear approval process for client names, site details and material intended only for a tender team.
Private documents become public downloads
A link to a tender room and a file uploaded to a public media folder have different access expectations. Decide which information belongs on the website before reviewing technical controls.
Old suppliers retain website access
A previous agency, freelance photographer or former colleague may still have an account. The website needs an owner who can review permissions and coordinate account changes without disrupting publishing.
Review the routes from first impression to project discussion.
These four journeys help define the public website review. Your construction business decides which domains, features and document routes are relevant; connected project systems need separate authorization.
Quote requestsContact forms, estimating enquiries and routing
Make the route to the estimating team accountable.
An enquiry may include a project location, an outline of the work and the buyer’s preferred contact method. Map the minimum information needed, the intended recipient and what the visitor sees after sending. Include regional contact pages and quote buttons that use different routes.
A review can examine the agreed website-side configuration and identify unclear ownership. Actual submissions or delivery tests require an approved method and sample content. Real prospect records are not needed for the initial scoping conversation.
Questions to settle before the review
- Recipients
- Who receives each form and who can edit that destination?
- Connected tools
- Does the request pass through a separate provider?
- Validation
- Which functional checks are expressly authorized?
Project portfoliosPhotographs, project descriptions and public claims
Control who can publish your project story.
Completed-work pages often draw on photographs, regional teams and agency contributions. Identify who approves publication and who can replace images, add links or change contact details. Website security addresses the publishing system; your team remains responsible for permission to publish client and project material.
Include project microsites and forgotten campaign pages when they matter to your business. A current homepage does not establish that an old property has an owner or a maintenance plan. Inventory the properties before assuming they are included.
Questions to settle before the review
- Approvals
- Name the person who approves project material.
- Permissions
- Separate editorial work from administration where supported.
- Older properties
- List relevant microsites and campaign domains.
Tender documentsPublic brochures and restricted file handoffs
Decide what belongs in a public website folder.
Capability brochures may be public; bids, drawings and client instructions may require a restricted process. Classify those uses before discussing access controls. Removing a download button does not establish that the file itself requires authentication.
If a quote form accepts attachments, agree that feature explicitly. File restrictions, storage location and retrieval permissions need review together. A separate tender portal or document-management platform remains outside the website engagement unless separately authorized.
Questions to settle before the review
- Audience
- Which document categories are public or restricted?
- Uploads
- Which file types and sizes does the business actually need?
- System boundary
- Where does the website hand off to a private platform?
Supplier and careers routesPartner enquiries and external application tools
Understand where visitors leave the website.
A supplier registration link, careers form or external project login may send a visitor to another organisation’s platform. Keep an inventory of these destinations and the people responsible for them. Review the website-side link and configuration within the agreed scope.
The external platform’s infrastructure, applicant records and private project workspace do not become part of the review because your website links to them. Record the handoff and refer platform concerns to the appropriate provider.
Questions to settle before the review
- Destinations
- Identify the intended provider and responsible contact.
- Website changes
- Who may add or replace these tools?
- Separate access
- Obtain a distinct scope for private platforms.
The systems, checks and technical work included in a review are agreed before access or testing.
Keep website maintenance out of the ownership gap.
An estimator may notice a missed request, marketing may publish project pages and an agency may manage updates. Give those teams a shared decision process for the public website.
- Account ownership
- Identify named website accounts, recovery contacts and the person who approves access. Discuss stronger sign-in controls supported by the platform without relying on shared credentials.
- Planned releases
- Agree who updates the CMS and extensions, when changes can occur and which enquiry routes need checking afterward. Define a rollback decision before a release.
- Recovery preparation
- Identify website backups, restoration responsibility and required approvals. A separate, authorized recovery exercise is needed to demonstrate a restore; the presence of backup files alone is insufficient.
- Unexpected behaviour
- Give estimators and marketing a route to report redirected forms, unfamiliar links or altered contact details. Confirm who can contact the host and maintenance provider.
For contractors with different ways of winning work.
The review follows the website’s role in your business. It does not assume every contractor uses online checkout or that a public site includes the project-management environment.
General contractors
Discuss regional enquiry routing, capability pages and the public links used by clients and potential subcontractors.
Specialist subcontractors
Focus on trade-specific project portfolios, quote requests and the website accounts used by a small office team or external agency.
Design and build teams
Clarify where public project stories end and restricted client collaboration begins, particularly when several providers maintain the digital journey.
Teams changing agency or relaunching
Include domain ownership, old accounts, form destinations and release responsibility in the handover discussion before the new site goes live.
Agree the website boundary, then investigate.
A useful review starts with how buyers reach your office. The methods, access and testing window are agreed before technical work.
Map the enquiry routes
List public domains, quote forms, portfolio pages and relevant external links. Explain which journeys matter to estimating and business development.
Confirm authority and scope
Name the website owner, hosting and maintenance contacts. Agree environments, checks, access and exclusions, including whether form tests are permitted.
Review the agreed website
Examine authorized configuration and evidence. Separate confirmed observations from unavailable access and matters requiring a third-party provider.
Assign and verify actions
Prioritize findings with the people responsible. Record approved changes, remaining work and the checks needed for affected enquiry and publishing routes.
A usable plan for the office and website team.
The proposal confirms the report format, technical depth and any remediation. Findings should be understandable to the people who approve changes and maintain the site.
Reviewed website inventory
The named domains, relevant enquiry routes and document handoffs, with exclusions and access limitations recorded.
Evidence and priorities
Observations explaining the affected behaviour and recommended actions. Priorities support decisions rather than predict a future incident.
A responsibility list
Actions assigned to your team, host, agency or platform provider. Completed remediation is distinguished from work still requiring approval.
Verification arrangements
Agreed checks after changes and outstanding questions about recovery or ownership. Ongoing monitoring and response commitments require a defined service.
A website review has a defined job.
Construction businesses use many systems to plan, cost and deliver work. Keep the public website engagement explicit so authorization does not drift into private operational or client environments.
Website and hosting
- Discussed in this review
- The named site, supplied CMS access and approved website hosting configuration.
- Agreed separately when needed
- Other domains, private accounts or environments not included in the agreement.
Enquiries and files
- Discussed in this review
- Agreed website-side form configuration, upload handling and public downloads.
- Agreed separately when needed
- Real bid contents, confidential drawings, client records and legal decisions about publication.
Project collaboration
- Discussed in this review
- Documenting the website’s links and handoffs to other providers.
- Agreed separately when needed
- Tender rooms, BIM platforms, project-management software, client portals and their infrastructure.
Business operations
- Discussed in this review
- Identifying the contact responsible for a connected website tool.
- Agreed separately when needed
- Accounting, payroll, operational site systems, machinery, building controls and internal networks.
Start with the support your website needs.
Discuss a defined assessment or a continuing maintenance arrangement. Work, availability and response expectations are confirmed before engagement.
A focused website review
Useful when you want clarity about quote routes, document exposure or publishing access before planning changes.
- Named domains and journeys
- Agreed evidence and methods
- Prioritised actions and owners
Continuing website care
Discuss regular security work when your office needs clear maintenance responsibility and a repeatable way to handle website changes.
- Defined maintenance tasks
- Agreed reporting and checks
- Explicit escalation arrangements
Bring the useful details to the first discussion.
Public information and business context are enough to begin scoping. Access and sensitive evidence belong in an agreed secure process later, when required.
- Website addresses
List the main domain, regional sites and any active project or campaign microsites. Identify which properties the business owns.
- Important enquiry journeys
Explain how prospective clients request quotes, which office receives them and whether different services use separate forms.
- Maintenance contacts
Name the agency, host or colleague who handles updates. Identify who can authorize technical website work.
- Document expectations
Say whether brochures are public and whether uploads or restricted downloads exist. Do not attach bids, drawings or client records.
- Upcoming changes
Mention an agency handover, relaunch, major tender deadline or planned content release that affects maintenance timing.
- Observed symptoms
Provide an affected public URL and a plain description of unexpected behaviour. Do not send passwords or private correspondence.
Guides for planning the next website step.
These existing guides help your office and maintenance provider prepare questions about review scope and recovery.
Website Security Audit: What Should Be Checked?
A good website security audit makes decisions easier. It should identify what was reviewed, explain relevant risks in context, and give clear priorities rather than…
Website Backup and Recovery Plan for Small Businesses
A backup is valuable only when it helps restore working services. Build your recovery plan around the website, database, integrations and people the business depends…
Further technical guidance
Construction website security questions.
Clarify the scope before handing over access or project information.
Does this cover our tender portal or project-management platform?
Not automatically. The public website’s links and handoffs can be discussed, but private platforms need separate authorization and a defined technical scope.
Should we send sample bids or drawings?
No. Describe the document workflow without attaching confidential material. If technical testing is agreed, use an approved method and suitable sample content.
Can you review a quote form with attachments?
We can discuss the website-side upload and retrieval approach. File restrictions, storage and permissions must be agreed together; functional submissions require explicit authorization.
What if an agency maintains the website?
Involve the agency in scope, access and change decisions. Agree who approves remediation and who verifies the enquiry routes afterward.
Can you check our project portfolio?
A scoped review can examine publishing permissions and the website configuration. Your business remains responsible for accuracy, client permission and whether material should be public.
Does this include WordPress?
WordPress Security may fit a WordPress site. WooCommerce Security is relevant only where that platform supports an online sales journey included in scope.
Will this guarantee that the website stays secure?
No. A review helps identify exposures and plan improvements within its scope. Maintenance, ownership and remaining limitations still matter afterward.
Tell us which website journey needs attention.
Share the public construction website and the concern: quote routing, project publishing, file handling, access or unexpected behaviour.
- Public URL
- Provide the business website address.
- Your concern
- Explain what the office or visitor is experiencing.
- Approval contact
- Identify who can authorize the proposed website work.
Leave confidential drawings, bids, passwords and client records out of the initial enquiry. Sending a request does not start technical testing.
Discuss your construction website
Continue with Construction selected in the existing enquiry form. You can edit the message before choosing whether to send it.
Industry: Construction
Share your website and concern in the existing enquiry form. Your industry follows you into the request.
- A public website URL is enough to begin.
- Access and technical work require an agreed scope.
- Please leave out sensitive or confidential information.
You choose whether to send the form. This page does not submit an enquiry or start a scan.