Website and Domain Audit

Overview

Most businesses do not know who owns their domain, where their website is hosted, or whether the backups work. This guide walks through the audit, in order of what matters most.

Domain Registration

For .au domains, use an auDA-accredited Australian tier-1 registrar. Synergy Wholesale, NetRegistry / VentraIP, Crazy Domains Business, and Hostopia are the established operators with direct auDA accreditation. For gTLDs (.com, .net, .org), Cloudflare Registrar offers at-cost pricing and strong security. Never use a reseller for anything important. Lock the domain. Enforce MFA on the registrar account.

• Registered in the business name, not an ex-employee or web agency
• Admin contact is reachable (real email, not a dead inbox)
• Held with an auDA-accredited registrar (Synergy Wholesale, VentraIP, Crazy Domains Business, Hostopia) for .au
• Cloudflare Registrar or equivalent at-cost registrar for gTLDs
• Registrar account has MFA enabled (phishing-resistant preferred for admins)
• Registrar lock / transfer lock enabled (prevents unauthorised transfer)
• Auto-renewal on for all critical domains
• Register relevant variants (.com, .com.au, .au, common misspellings)
• Transfer AUTH codes stored securely in password manager
• auDA eligibility evidence retained (ABN / ACN matching the registrant)

DNS

• DNS hosted at a professional provider (Cloudflare, Route 53, Azure DNS). Not at your web host.
• DNSSEC enabled where supported
• MX records match your email provider
• SPF record published, covers every sender, ends with -all (see Email Auth Guide)
• DKIM selectors published per service
• DMARC at p=reject or p=quarantine with reporting
• CAA record restricts which CAs can issue SSL for the domain
• No stale records pointing to dead services

Hosting

• Reputable provider (Cloudflare Pages, AWS, Azure, Pantheon, Kinsta, WP Engine, Hostinger Business, SiteGround, Digital Pacific, VentraIP business tiers)
• Located in Australia or acceptable region for your audience
• Daily backups with 30+ day retention
• WAF (Web Application Firewall) enabled
• CDN (Cloudflare or similar) in front of the origin
• TLS 1.2 minimum, TLS 1.3 enabled
• Server software (PHP, Node, MySQL) on supported versions
• Admin panel behind MFA

SSL and Security Headers

• Valid SSL certificate, auto-renewing (Let's Encrypt or commercial)
• HTTP forced to HTTPS via 301 redirect
• HSTS header with preload where possible
• Content-Security-Policy header
• X-Frame-Options / frame-ancestors
• Referrer-Policy
• Use securityheaders.com and ssllabs.com to test

Website Backups

• Daily automated backups of files and database
• Stored offsite from the hosting provider
• Restore tested quarterly
• 30+ day retention
• Includes both code/files and database
• Backup not accessible from the admin panel alone (immutable option preferred)

WordPress and CMS Security

WordPress still powers a huge portion of Australian SMB websites. Also the most attacked platform on the web.

• WordPress core, theme, and every plugin on the latest version
• Remove unused themes and plugins (every one is an attack surface)
• Admin username is not "admin"
• MFA on all admin accounts (Wordfence, iThemes Security, Cloudflare Access)
• Limit login attempts, block known-bad IPs
• XML-RPC disabled unless required
• File editing disabled in wp-config.php (define WP_DISALLOW_FILE_EDIT)
• Security plugin installed (Wordfence, Sucuri, or Patchstack)
• Reviewed quarterly, not just when something breaks

Transactional Email / SMTP

Forms, order confirmations, password resets, newsletters. Sent via your SMTP relay, not your M365 mailbox. Otherwise SPF breaks, deliverability tanks, and your domain gets flagged.

• Use a dedicated transactional provider (SendGrid, Postmark, Mailgun, Amazon SES, Resend)
• Published in SPF, DKIM signed, DMARC aligned
• Monitor bounce and complaint rates
• Separate sending domain for marketing email (mail.example.com.au)
• Never send transactional from your human mailbox

Common Mistakes