A promising brief reaches the wrong inbox
A producer leaves, a CRM changes or a notification is copied to a former contractor. Your public form may still appear to work while its destinations and stored copies need attention.
Website security for agencies
Website security for agencies.
Look after the website behind your next brief, with clearer ownership of enquiries, portfolio publishing, campaign pages and contractor access.
Your work earns the visit. The website needs to handle what follows.
An agency website connects your reputation to a prospective client's next step. A polished portfolio can hide an old form recipient, an abandoned campaign page or a supplier account that nobody on the current team owns.
Project materials remain public after a handover
A portfolio download, preview link or demonstration page can outlive the project that created it. Staff need to know which materials are approved for public access and who can remove or update them.
Campaign pages keep their old dependencies
A landing page may retain a booking embed, tracking tag or integration from a previous campaign. The component owner and the website change plan should remain clear when the campaign team moves on.
Freelancer access becomes permanent by accident
A rebrand or busy delivery period can bring several people into the agency's own CMS and hosting. Shared accounts and unclear recovery contacts make the next handover harder to manage.
Review the routes behind your agency website.
Choose a public website journey below. We agree the domains, components, access and checks included before work starts, including where a form service, CRM or another supplier takes over.
Incoming briefsEnquiry forms and file handling
Know where the brief goes after someone sends it.
Your enquiry journey may pass through a form plugin, notifications, a shared mailbox and a connected CRM. A defined review can trace the agreed website-side route and identify who owns its fields, recipients, stored copies and failure handling.
If the site accepts attachments, we can discuss the upload feature as an explicit part of the scope, including permitted file handling, limits, storage and retrieval access. A general enquiry does not need client proposals, budgets, credentials or unpublished creative material. Any later synthetic submission is agreed with its recipients first.
Questions a scoped review can resolve
- The public request
- The included forms, information requested and context carried into a mailbox or CRM.
- Recipients and retained copies
- Current owners of notifications, website-side storage and connected destinations after staff changes.
- Attachments, where present
- The agreed upload feature and the person responsible for its configuration, storage and access controls.
Portfolio publishingCase pages and public assets
Keep public work separate from working material.
Case pages can draw on a CMS library, downloadable documents, embedded video and external asset storage. We can review the agreed publishing setup and identify which website accounts and components can change those public materials.
Your agency confirms which work is approved for publication and who owns it. The technical review can record relevant public links and access boundaries; it does not establish copyright permissions, client approval or the confidentiality of every file held in a separate project workspace.
Questions a scoped review can resolve
- Public portfolio surfaces
- Named case pages, download links and media destinations included in the review.
- Publishing permissions
- The staff and suppliers who can edit the CMS, replace assets or change public links.
- A clear handover
- Ownership of obsolete previews, demonstration pages and material that your team decides to retire.
Campaign pagesAgency landing pages and legacy links
Include the pages outside the main portfolio.
An agency's own event page, lead magnet or campaign microsite can have different forms and maintainers from its main domain. We can include named public surfaces and the website-side dependencies that matter to their enquiry or booking journeys.
The scope should identify who maintains each domain, who can approve a change and what happens when a campaign ends. Client-owned campaign sites are separate assets and require their own explicit authorization; access to the agency website does not authorize work on them.
Questions a scoped review can resolve
- The named domains and pages
- Included agency-owned landing pages, microsites, downloads and legacy campaign links.
- Campaign dependencies
- Agreed website components, booking routes, embeds and the contacts responsible for them.
- Change and retirement decisions
- Which public journey to recheck and who approves keeping, redirecting or removing an old page.
Connected toolsCRM, booking, media and tags
Give each website connection a responsible owner.
Booking tools, chat, embedded media, CRM connections and marketing tags can involve several agency specialists. We can inventory the agreed connections and distinguish settings controlled in the website from changes that belong to a separate provider account.
Third-party scripts can affect page behaviour and data flows. The review can identify the included components, their maintainers and relevant change dependencies. It does not automatically assess the supplier's whole platform, an advertising account or the private customer records held in your CRM.
Questions a scoped review can resolve
- The connected functions
- The forms, embeds, scripts and outbound services used by the reviewed public pages.
- Account and component ownership
- Who maintains the website-side setup and who can approve a provider-side change.
- Verification after changes
- The agreed public journeys and supplier handoffs to recheck after included work.
The systems, checks and technical work included in a review are agreed before access or testing.
Make the next staff or supplier handover easier.
Your own website can receive less attention than a client launch. Agree practical responsibilities for publishing, maintenance and recovery so it has a clear owner between projects.
- Review agency and contractor accounts
- Discuss named CMS and hosting accounts, appropriate publishing roles, recovery contacts and multi-factor authentication where supported. Permission changes and removals are agreed with the authorized owner before implementation.
- Prepare for a controlled release
- Identify staging options, usable website backups and the person who approves production work. Account for active campaigns, rebrands, custom components and dependencies maintained by another supplier.
- Recheck the routes behind new business
- Verify the agreed enquiry, booking, portfolio and download journeys after included changes. Record supplier-side issues and follow-up actions rather than assuming that a working homepage proves every connection works.
For the agency's own public website.
This page concerns the website your agency uses to win work and explain its services. Support for a portfolio of client-owned websites is a separate conversation through Agency Partnerships.
Digital and web agencies
Review your own marketing domain, demonstration links, CMS publishing and incoming project enquiries. Name any client-facing systems separately rather than treating the whole delivery environment as included.
Creative and branding studios
Account for public work, case-study downloads, embedded media and the people who publish them. Your team remains responsible for confirming which materials have permission to appear online.
Marketing and campaign teams
Include agreed agency-owned landing pages, booking routes and connected marketing tools. Clarify responsibility when specialists, campaign owners or external providers change.
Start with a public journey. Finish with an owned action plan.
We define the website boundary before reviewing it, then connect observations to the staff or suppliers who can act. An initial enquiry does not authorize testing or changes.
Agree the agency website boundary
List the domains, portfolio surfaces and enquiry routes to include. Identify the authorized website owner and distinguish agency assets from client sites, private project tools and provider platforms.
Review the included setup
Examine the agreed website components, account ownership, public publishing and form connections. Explain findings using the evidence available within the authorized review.
Coordinate the included improvements
Agree priorities, dependencies and release timing. Implement the hardening or repairs listed in the proposal with suitable backup, rollback and functional checks for those changes.
Verify and assign the next actions
Recheck the agreed journeys. Document completed work, unresolved limitations and tasks for your agency, website developer, host or connected-tool provider.
A handover that fits the way your agency works.
The handover separates observations, recommended work and changes actually completed. It gives the agency's website owner a usable record to discuss with staff and existing providers.
A record of the reviewed surfaces
The domains, public journeys, connected components and website boundaries considered, with responsible contacts where established.
Priorities with agency context
What was observed, which enquiry or publishing route it affects and the dependencies to resolve before acting. Relevant evidence should avoid unnecessary confidential client material.
A change and verification record
Included work completed, checks performed and remaining limitations. Provider tasks and items requiring a separate decision are clearly identified.
A practical ownership handover
Actions for staff, freelancers, the host or another provider, with ongoing maintenance and response responsibilities stated only where they form part of the agreed arrangement.
Your website, client sites and project tools have separate boundaries.
An agency may have access to many systems without owning them. The proposal names the assets and technical work that can be authorized for this engagement.
The agency's public website
- Discussed in this review
- Agreed agency-owned domains, CMS components, publishing access, enquiry routes and website-side integrations.
- Agreed separately when needed
- Client-owned websites, private workspaces, production repositories or additional applications that are not explicitly named and authorized.
Public work and incoming files
- Discussed in this review
- The defined publishing setup, public links and any upload feature specifically included in the website review.
- Agreed separately when needed
- Copyright clearance, client approval, legal advice or a review of every confidential proposal and project file held outside the website.
Implementation and continuing support
- Discussed in this review
- The checks, included configuration changes and handover described in your proposal.
- Agreed separately when needed
- A rebuild, migration, restore exercise, provider-wide assessment or continuing monitoring and incident response unless separately agreed.
Choose support around your own website's needs.
Start with a defined review before a rebrand or supplier handover, or discuss recurring website care. Scope, access, deliverables, timing and commercial terms are confirmed before technical work.
A focused agency website review
For an agency that wants a clearer view of its own enquiry routes, publishing setup and website responsibilities before deciding on improvements.
- Named agency-owned domains and journeys
- Agreed review and included hardening
- Priorities and a practical handover
Continuing care for the agency site
For a team that wants defined maintenance tasks and an agreed way to raise website concerns alongside its regular client work.
- A stated routine for website care
- Coordination with staff and suppliers
- Agreed escalation and response arrangements
Bring the website context, not the confidential brief.
A public URL and a short description are enough to enquire. These details help define useful work without collecting client proposals, unpublished creative work or access credentials through a general contact form.
- The agency-owned domains
List the main website and any agency campaign pages or microsites you are authorized to discuss. Identify which enquiry or publishing journey needs attention.
- How requests reach your team
Describe whether a form connects to email, a booking tool or a CRM. Mention any attachment feature without sending real submissions, budgets or confidential project details.
- The people and providers involved
Name the internal website owner, development partner, host and relevant tool providers. Explain who can approve access and production changes.
- The upcoming change or concern
Mention a rebrand, freelancer departure, migration, campaign deadline or suspicious behaviour. Describe the situation without including passwords, access tokens or private client materials.
Prepare your agency's next website decision.
Use these existing guides to prepare questions about a scoped security audit and a recovery plan. They can help your website owner and delivery team agree what needs reviewing.
Website Security Audit: What Should Be Checked?
A good website security audit makes decisions easier. It should identify what was reviewed, explain relevant risks in context, and give clear priorities rather than…
Website Backup and Recovery Plan for Small Businesses
A backup is valuable only when it helps restore working services. Build your recovery plan around the website, database, integrations and people the business depends…
Questions from agency website teams.
Start with the agency's own public website and the concern you want to resolve. The first conversation identifies a suitable boundary and the people who need to take part.
How is this different from Agency Partnerships?
This industry page focuses on your agency's own marketing website, public work and incoming enquiries. Agency Partnerships is the separate service conversation for supporting websites you manage for clients. Client-owned assets need their own named scope and authorization.
Can you review a form that accepts project brief uploads?
We can discuss the particular form and upload feature to include. The scope can define the website-side file handling, storage, access and related configuration checks. Do not send real briefs or client attachments in the initial enquiry. Any later synthetic submission is agreed with the receiving team first.
Does a portfolio review confirm that client work is safe to publish?
No. We can examine agreed website publishing permissions, public links and relevant technical boundaries. Your agency and the relevant rights holders remain responsible for publication approval, copyright and confidentiality decisions. Legal advice and a review of separate project repositories are not automatically included.
Can you help with access left behind by freelancers?
We can review the agreed website accounts, permissions and recovery ownership. Account removals or changes are approved by the authorized owner before implementation, with care for connected functions and current maintainers. A wider review of every business account is a separate scope.
What if another provider runs our CRM, booking or video service?
The review can include the agreed website-side connection and who owns the provider relationship. Assessing the supplier's entire service, private CRM records or a separate advertising platform is not automatic. The relevant provider may need to investigate or implement changes in its own environment.
Will you send enquiries or change live campaign pages during a review?
Not simply because you enquire. Testing, access and implementation follow an agreed scope and change plan. Where synthetic form testing is included, the recipients and test details are agreed in advance. Production changes account for the public journeys and release dependencies named in the proposal.
How do we get a quote and timeline?
Share your public agency domains, the main concern, current website owners and any important rebrand or campaign dates. We discuss the work, dependencies and access needed, then confirm a tailored quote and timeline before implementation. A website review is not a security or compliance guarantee.
Give your own agency website a clear next step.
Tell us which public enquiry or publishing journey needs attention and who maintains the website today. We will discuss a practical scope with the staff and providers who can act on it.
- Share the agency website
- A public domain and a short description of the concern.
- Name the responsible people
- Include the agency owner, current maintainer and connected providers.
- Agree the work first
- Review scope, timing, responsibilities and a tailored quote before technical work.
No passwords, proposals or unpublished client work are needed to enquire.
Discuss my website
Continue to the existing enquiry form with Agencies already carried into the request.
Industry: Agencies
Share your website and concern in the existing enquiry form. Your industry follows you into the request.
- A public website URL is enough to begin.
- Access and technical work require an agreed scope.
- Please leave out sensitive or confidential information.
You choose whether to send the form. This page does not submit an enquiry or start a scan.