Visitors reach the wrong booking destination
An exhibition page may remain online after the ticketing route changes. Old campaign links, embedded calendars and multiple venue choices can send visitors to an outdated event or unfamiliar checkout.
Website security for arts and cultural organisations
Keep culture connected.
Security for cultural websites, public collections, bookings and donations, with clear platform responsibilities.
Your website is part of the visitor experience.
An exhibition launch, a collection discovery or a supporter campaign can depend on several systems. When a link or account fails, front-of-house and communications teams need to know who can resolve it.
Public collection material exposes more than intended
A public object description is different from a restricted catalogue record. Media exports, document downloads and unreviewed uploads can cross that boundary unless publication and technical access have clear owners.
A donation route changes without clear approval
The campaign page, payment service and supporter database may have separate administrators. A working donation button does not show who controls the destination or reconciles the acknowledgement.
Editorial access outlasts an exhibition
Guest curators, seasonal staff, volunteers and agencies may retain accounts. Updating programme content should not automatically allow changes to software, donation settings or restricted submissions.
Follow the visitor and supporter journeys that matter.
Choose a route to explore. The scope starts with your actual website features and the points where collection, ticketing, membership or fundraising providers take over.
Digital collections and public publishingApproved media, downloads and editorial boundaries
Decide what belongs on the public website before it is uploaded.
An online collection can include object descriptions, photographs, exhibition essays and downloadable learning material. Some content is managed directly in the website; other content arrives from a collection-management system. Identify which publication is authoritative, who approves it and how corrections reach the public page. The website copy and the underlying collection record may have different owners.
An agreed review can examine included publishing roles, public media routes, document access and the website-side configuration used for imports. Distinguish content intended for discovery from restricted records, unpublished research and internal contact details. A file attached to a public page needs a deliberate publication decision. Copyright, reproduction rights, provenance and cultural-sensitivity decisions remain with the organisation and its relevant advisers.
Use approved sample material for checks. Do not provide loan agreements, private donor correspondence or restricted collection exports through the initial enquiry. Identify who can approve a replacement file and which public links need updating afterward. The engagement does not automatically cover the collection platform itself, digitisation storage or long-term preservation; those systems require their own authority and recovery arrangements.
What an agreed review can examine
- Publication source
- Identify website-managed content, catalogue imports and the responsible editor.
- Public and restricted material
- Define intended access to media, documents and sample collection content.
- Correction workflow
- Agree who approves changes and which public routes must be rechecked.
Exhibitions, tickets and visitor bookingsEvent destinations, timed entry and confirmations
Make the route from exhibition page to confirmed visit clear.
Visitors may move from a programme page to a timed-entry provider, workshop form or group-visit enquiry. Record whether the website requests interest or confirms a booking. Identify where dates, capacity, pricing and confirmation messages are controlled. A public calendar can look current while its outbound link still refers to a previous exhibition or venue.
The review can cover official destinations, embedded booking tools and included website settings. Provider administration, private attendance lists and wider ticketing infrastructure are separate areas. Name the venue contact who can confirm the correct event and the supplier administrator who owns the booking configuration. Website access alone does not authorize examination of every record available in the ticketing service.
Plan checks without taking a ticket, changing capacity, sending a reminder or notifying front-of-house. Explicit agreement and suitable test facilities are needed for transactional verification. Document which public routes were checked and whether checkout, confirmation or admission was left unverified. Refund rules, admission decisions and visitor-service policies remain operational responsibilities rather than conclusions from a website security review.
What an agreed review can examine
- Expected visitor outcome
- Separate an enquiry, a requested time and a confirmed ticket or booking.
- Event and provider ownership
- Name the official venue, event destination and supplier administrator.
- Capacity-aware checks
- Agree limits before reservations, cancellations, reminders or charges.
Donations, supporter campaigns and online salesPayment handoffs, acknowledgements and shop checkout
Know who owns each step of the supporter’s payment journey.
A donation campaign may link to a fundraising service, embed a payment form or use an on-site feature. A museum shop may use a different checkout altogether. Map the website route, payment destination and system responsible for acknowledgement. A supporter record or finance reconciliation may be held elsewhere even when the public experience carries the same branding.
Included work can examine website-side settings and relevant commerce dependencies. Where WooCommerce genuinely handles shop orders or another agreed checkout, scope its extensions and configuration explicitly. A hosted donation link has a different boundary. Gift terms, tax treatment, fundraising requirements, donor restrictions and financial reporting are matters for the organisation’s responsible staff and advisers, not assurances supplied by website security work.
Any test that could charge money, create an order, issue a receipt or add a supporter to a campaign needs explicit authority and appropriate test facilities. Avoid live donor records when explaining a concern. If a destination changes unexpectedly, preserve useful evidence and coordinate investigation before replacing it. Record which downstream outcomes remain unverified rather than treating a loaded payment page as proof of the entire workflow.
What an agreed review can examine
- Payment model
- Distinguish hosted fundraising links, embedded forms and on-site checkout.
- Supporter-system boundary
- Identify acknowledgement, record ownership and finance contacts.
- Transaction limits
- Agree test facilities and exclude live donations or purchases unless separately authorized.
Memberships, accounts and restricted digital contentSign-in, recovery and audience permissions
Match account permissions to the audience you intend to serve.
A member may sign in to manage preferences, access exclusive recordings or book an advance event. Staff may administer those functions in a separate membership platform. Record official account destinations and recovery contacts before someone loses access. Branding alone does not establish that the website, ticketing service and supporter system share one account or set of permissions.
For included website accounts, an agreed review can examine supported sign-in protection and recovery arrangements. OWASP authentication guidance covers recovery, multi-factor authentication and protection against automated login attempts. Which controls can be applied depends on the platform. Access to private programme content also needs a clear statement of which sample roles should see each resource.
Use authorized sample accounts and fictional records for any restricted-feature checks. Define permitted actions before changing preferences, benefits or membership status. Do not use a real supporter’s account to demonstrate a concern. Provider-held donation histories, private correspondence and the supplier’s infrastructure require separate authority. A website backup should not be assumed to restore external memberships or account history.
What an agreed review can examine
- Account destinations
- Separate public website accounts, member portals and staff administration.
- Recovery ownership
- Identify supported protections and the organisation’s recovery contact.
- Expected permissions
- Define sample roles, restricted resources and actions permitted during checks.
The systems, checks and technical work included in a review are agreed before access or testing.
Keep website work aligned with the exhibition programme.
Launch dates, visiting contributors and changing teams create practical maintenance demands. Give editorial approval, technical changes and provider questions named owners.
- Review access at handovers
- Identify communications editors, curators, fundraising staff, volunteers, agencies and hosting administrators. Revisit permissions when an exhibition closes or a contract ends. Discuss supported sign-in protection and account recovery without relying on one shared administrator account.
- Plan releases around public commitments
- List representative collection pages, ticketing links, campaign routes and account features before included changes. Agree staging, rollback and a business approver. A launch may involve several suppliers; record what each party checks and who can pause or reverse a change.
- Maintain the whole website setup
- Name the owners of the CMS, theme, extensions, media imports and embedded services. WordPress hardening guidance treats access limits, software maintenance and backups as parts of the wider setup. An installed security extension does not establish ownership for every integration.
- Prepare recovery across content systems
- Identify which files, database records and website settings are backed up. Account for recent editorial corrections and transactions before restoration. Collection assets, ticketing records and supporter data may live elsewhere. An isolated restore exercise and reconciliation work are included only when explicitly agreed.
For organisations connecting culture with public audiences.
A museum, a community arts centre and a membership society can share website tools while serving different audiences. The review follows the actual content and platform boundaries.
Museums, galleries and heritage venues
Focus on approved digital collections, exhibition pages, visitor information and booking handoffs. Keep restricted catalogue records, loan documentation and internal research within their own access arrangements.
Arts centres and cultural programmes
Map workshop enquiries, programme calendars, participant registration and visiting-contributor access. Separate public website work from operational safeguarding and programme eligibility decisions.
Cultural societies and membership organisations
Review account destinations, member-only publications, joining routes and supporter communications. Identify who controls benefits, payment settings and recovery in each connected platform.
Multi-venue teams and website agencies
Coordinate editorial owners, hosts, collection suppliers and ticketing administrators. A redesign or provider handover should include public links, access recovery and unresolved integration questions.
Begin with a public route and a clear expected outcome.
Describe what a visitor, reader or supporter should be able to do. That creates a concrete brief before access, sample material or technical work is arranged.
Describe the public journey
Share the collection page, exhibition route, campaign or account link and the concern. Leave out supporter records, restricted collection information and private correspondence.
Agree systems and authority
Name domains, website features, suppliers and business approvers. Identify checks that could reserve capacity, send messages, charge money or alter membership status.
Review included controls and evidence
Examine agreed website settings and observations with suitable samples. Separate confirmed website findings from supplier questions and areas needing further permission.
Coordinate actions and verify changes
Assign included fixes to accountable owners. Record the public routes checked afterward, remaining limitations and the maintenance or recovery responsibilities handed over.
A handover the cultural team and its suppliers can use.
The proposal defines report depth, implementation and follow-up. Findings should connect an observed website issue to its public journey and the person who can act.
An included-systems and journey map
Named domains, public collections, booking destinations, donation routes and account areas examined, with supplier boundaries and access limits documented.
Findings in operational context
What was observed, why it matters to the included function and the recommended response. Restricted evidence follows the handling arrangements agreed for the engagement.
Priorities with responsible owners
Included fixes, editorial approvals and supplier dependencies assigned to the organisation, agency, host or platform administrator. Further authority remains clearly identified where needed.
Verification and recovery notes
Completed changes, checks performed and outcomes left unverified. Capture recovery contacts and recurring maintenance needs; ongoing monitoring and incident availability require an appropriate continuing agreement.
Agree website responsibilities without blurring cultural ones.
The written engagement names the systems, methods and implementation included. A public website connection does not grant access to every record behind it.
Public content and collections
- Discussed in this review
- Included publishing roles, public media routes and website-side import configuration.
- Agreed separately when needed
- Copyright, reproduction rights, provenance, cultural-sensitivity decisions or unrestricted collection-system access.
Visitor and supporter journeys
- Discussed in this review
- Agreed forms, official handoffs and explicitly authorized website features.
- Agreed separately when needed
- Live ticket reservations, donor communications, membership changes or unrestricted participant records.
Commerce and provider systems
- Discussed in this review
- Included website-side payment links and genuine on-site checkout settings.
- Agreed separately when needed
- Live charges, refunds, finance reconciliation and provider infrastructure outside the agreed scope.
Assurance and preservation
- Discussed in this review
- Website observations, agreed technical actions and verification in named environments.
- Agreed separately when needed
- Legal advice, compliance certification, long-term digital preservation programmes or guarantees against every security risk.
Choose support around your next public launch.
A focused review can establish priorities before a change. Continuing care can give recurring website work an owner. Scope, quotation and provider coordination are confirmed before technical work.
A defined cultural website assessment
Useful before opening exhibition bookings, replacing a collection interface, launching a supporter campaign or handing the website to another agency. Start with the public journey and the decision the review needs to support.
- Named features and permitted checks
- Approved samples and transaction limits
- Prioritized actions and supplier questions
Continuing website protection
Discuss recurring care where updates, access reviews and release checks compete with a busy programme. Define reporting, escalation and the boundaries between the organisation and its platform suppliers.
- Agreed recurring website tasks
- Defined reporting and response scope
- Recovery and provider coordination
Bring the public journey and the people who own it.
A public URL and a short description are enough to start. Technical access and restricted evidence can be arranged later through an agreed process.
- Websites and venues
List relevant organisation domains, exhibition microsites and location pages, including who controls each one.
- Publishing and collection sources
Explain whether content is edited in the website or imported. Identify who approves media and public collection material.
- Ticketing and visitor routes
Name booking providers and administrators. Explain whether the route collects an enquiry or confirms a ticket.
- Donation, membership and shop services
Distinguish hosted links from on-site features. Identify payment, acknowledgement and account responsibilities without sharing supporter records.
- People and handovers
Name the organisational approver, agency, host and platform suppliers. Mention staff, volunteer or contractor transitions affecting access.
- Symptoms and launch dates
Share the public URL, expected result and relevant programme timing. Leave out donor details, private records, payment information and passwords.
Prepare a useful review and recovery brief.
These existing Defendoria guides help cultural teams and their website partners discuss audit scope, practical deliverables and restoration responsibilities.
Website Security Audit: What Should Be Checked?
A good website security audit makes decisions easier. It should identify what was reviewed, explain relevant risks in context, and give clear priorities rather than…
Website Backup and Recovery Plan for Small Businesses
A backup is valuable only when it helps restore working services. Build your recovery plan around the website, database, integrations and people the business depends…
Further technical guidance
Arts and cultural website security questions.
Clarify the public journey, publication boundary and platform owner before arranging access.
Can you review a site connected to a collection-management platform?
An agreed review can include public collection routes, website-side imports and publishing controls. The collection platform, restricted records and digitisation storage need separate authority. Publication rights and cultural decisions remain with the organisation’s responsible people.
Will you buy tickets or make a test donation?
No transaction is assumed. Explicit agreement and suitable test facilities are needed for ticket reservations, messages, donations, orders or membership changes. The handover identifies any downstream outcomes that remain unverified.
Can you review our museum shop?
Relevant commerce features can be scoped where they exist. Identify genuine on-site checkout separately from a hosted shop or payment link, and name the provider responsible for fulfilment and finance questions. Live purchases and refunds require separate agreement.
Do you need donor lists or restricted collection records?
Not for the initial enquiry. Start with a public URL and a workflow description. Use approved fictional samples for authorized checks. Any later need for restricted evidence requires an agreed purpose, access boundary and handling process before sharing.
Does a public file URL mean a document is appropriate to publish?
Technical availability does not replace publication approval. The organisation should identify intended audiences and the person responsible for rights, sensitivity and content decisions. Included website work can examine the agreed technical access arrangements.
Can you work with our existing agency and specialist suppliers?
Included work can be coordinated with authorized contacts. Name the organisational approver, website agency, host and collection, ticketing or membership administrators so changes, rollback and remaining actions have clear owners.
Does this certify compliance or replace a preservation plan?
No. The engagement provides observations and agreed actions for a defined website environment. It does not certify legal compliance, establish reproduction rights or replace digital preservation arrangements, and it cannot eliminate every security or availability risk.
Start with the public journey your organisation depends on.
Tell us about a collection page, visitor booking, donation route or account handoff that needs attention. We can discuss suitable scope before arranging technical access.
- Public website
- Share the organisation or programme page.
- Expected outcome
- Describe the intended visitor, reader or supporter experience.
- Responsible contact
- Identify the organisational approver and website provider.
Do not send donor lists, participant details, restricted collection records, payment information or passwords. An enquiry does not authorize scanning, testing or access.
Discuss website security
Continue to the existing enquiry form with Arts & Cultural Organizations selected. You can edit the message before choosing whether to send it.
Industry: Arts & Cultural Organizations
Share your website and concern in the existing enquiry form. Your industry follows you into the request.
- A public website URL is enough to begin.
- Access and technical work require an agreed scope.
- Please leave out sensitive or confidential information.
You choose whether to send the form. This page does not submit an enquiry or start a scan.