Website security and compliance in Abu Dhabi:a hardening guide

For an Abu Dhabi business website, start with security and compliance before speed or design: know which data protection rules apply (the federal PDPL for most businesses, and the ADGM Data Protection Regulations 2021 if you are established in Abu Dhabi Global Market), collect only the data you need, and harden the site with two-factor logins, least-privilege accounts, automatic updates, a firewall, off-site backups, logging and a written incident plan. Most of this takes an afternoon and costs nothing.

A made-up story worth learning from. A small Abu Dhabi consultancy hired a freelancer to build its site two years ago. The freelancer still has an administrator login, the contact form stores every enquiry forever, and three plugins have not been updated since launch. Nobody did anything wrong on purpose. The risk simply piled up quietly, which is exactly how most small-site incidents start.

By the end of this guide you will understand the basic rules in plain language, and you will have worked through a practical hardening walkthrough for a WordPress site on cPanel hosting, plus an incident checklist you can print.

What security and compliance mean for a small website

Think of your website like an office. Compliance is the set of building rules: what records you may keep, who may see them, and what you must tell visitors. Security is the locks, keys and alarms: who has a key, whether the locks are modern, whether the alarm is on, and what everyone does if there is a break-in.

You need both. Good locks do not help if you are keeping records you should not have, and a perfect privacy notice does not help if anyone can walk in through an old plugin.

The rules that may apply to you

This section is general information, not legal advice. Check the official text and speak to a qualified adviser for decisions about your business.

The federal PDPL

Most UAE businesses fall under Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data. According to the official UAE government portal, it came into force on 2 January 2022, applies to processing of personal data inside or outside the country, prohibits processing without consent except in specific cases, gives people the right to correct inaccurate data and to restrict or stop processing, and sets requirements for cross-border transfers. Our UAE hosting pillar guide summarises it in more detail.

The ADGM Data Protection Regulations 2021

Abu Dhabi Global Market (ADGM), Abu Dhabi's international financial centre, has its own regime. According to ADGM's official announcement and its overview brochure:

• Enacted in February 2021, modelled on the European Union's General Data Protection Regulation (GDPR).
• Applies to all entities established in ADGM that process personal data, or process it in the context of the activities of an establishment in ADGM.
• Transition periods: 12 months for existing establishments and 6 months for new ones, counted from 14 February 2021, so both have long ended.
• Oversight: an independent Office of Data Protection, headed by a Commissioner of Data Protection, monitors compliance, handles complaints, investigates breaches and issues guidance.
• People's rights include transparent information, being informed about data collection, access and rectification, objecting to processing, and requesting deletion.
• Extra duties: data protection impact assessments for high-risk processing, and a data protection officer for certain types of entity.

Sector rules

Some sectors have their own rules on top. The UAE government portal lists, for example, Federal Law No. 2 of 2019 on the use of ICT in health fields. If you handle health, financial or children's data, get specific advice.

What this means for a website

Whichever regime applies, the website tasks look similar:

• A clear privacy notice saying what you collect, why, who receives it, where it is stored and how long you keep it.
• Consent where it is needed, for example an unticked checkbox for marketing emails on your contact form.
• Minimal data: collect only the fields you actually use.
• Access control: only the right people can see the data.
• Security safeguards and a plan for when something goes wrong.

The rest of this guide covers how to do those things in practice.

Before you start

• Logins: your hosting control panel, WordPress administrator account, domain registrar and email admin.
• A smartphone with an authenticator app such as Google Authenticator or Duo Mobile.
• A full, recent backup downloaded to your computer. If you have never done this, our UAE hosting company vetting guide shows the cPanel steps.
• A list of everyone who has, or had, access to the site.
• Two to three hours, ideally at a quiet time for your business.

Risk level: low to medium. Most steps are settings changes; the file permission and firewall steps can break things if done carelessly, so take the backup first.

Step 1: Map your data and write the privacy notice

Open a simple document and answer these questions for your site:

• What you collect: contact form fields, newsletter sign-ups, booking details, account logins, analytics data, chat messages.
• Why: answering enquiries, sending quotes, marketing, improving the site.
• Where it goes: the hosting server, your email inbox, a CRM, a form plugin's cloud service, analytics, chat widgets.
• How long you keep it: set a period for each type. Some contact form plugins keep entries in the database until you delete them, so check the plugin settings.
• Who can see it: list the people and services.

Then write the privacy notice from those answers, in plain language, and link it from your footer and next to every form. Remove form fields you do not genuinely need. A phone number field you never call is personal data you have to protect for nothing.

Step 2: Turn on two-factor authentication everywhere

Two-factor authentication (2FA) means logging in needs your password plus a six-digit code from your phone. A stolen password alone is then not enough.

In cPanel

cPanel's documentation describes these steps from the Two-Factor Authentication interface in the Security section:

1. Click Set Up Two-Factor Authentication.
2. Scan the QR code with your authenticator app, or type in the account and key shown.
3. Enter the six-digit security code from the app in the Security Code box before it expires.
4. Click Configure Two-Factor Authentication.

cPanel's documentation lists Google Authenticator for Android and Duo Mobile for iOS. If you lose the phone and cannot log in, you have to ask your hosting provider to disable 2FA on your account, so store your recovery details safely.

In WordPress

WordPress does not include 2FA by default, but the free Two Factor plugin, maintained by a community of WordPress contributors, adds it. At the time of writing, its WordPress.org page lists more than 100,000 active installations and testing up to WordPress 7.1.2.

1. Install and activate Two Factor from Plugins > Add New Plugin.
2. Go to Users > Profile and scroll to Two-Factor Options.
3. Enable the authenticator app (TOTP) method and scan the QR code with your phone.
4. Generate backup codes and store them somewhere safe, offline.
5. Ask every administrator and editor to do the same.

The plugin also supports one-time codes by email, which are better than nothing for less technical users. Do not forget the other doors: turn on 2FA for your domain registrar, your email accounts and Cloudflare if you use it.

Step 3: Give everyone the least access they need

Least privilege means each person gets only the access their job needs. WordPress's built-in roles make this straightforward. From WordPress's own documentation:

• Administrator: has access to all the administration features within a single site.
• Editor: can publish and manage posts, including other users' posts.
• Author: can publish and manage their own posts.
• Contributor: can write and manage their own posts but cannot publish them.
• Subscriber: can only manage their profile.

Go to Users > All Users and review every account:

• Delete accounts for people who have left, including old freelancers and agencies. WordPress offers to reassign their content when you delete them.
• Downgrade anyone who only writes content from Administrator to Editor or Author.
• Keep two administrators at most, both with 2FA.
• Rename risky usernames: WordPress's hardening guide warns that default names such as "admin" are typically attacked first. Create a new administrator with a unique name, log in as it, then delete the old one.
• Never share logins. Each person gets their own account, so the logs show who did what.

If you use WP-CLI on your server, this lists every administrator in one command:

wp user list --role=administrator --fields=ID,user_login,user_email

Step 4: Keep software updated automatically

Out-of-date plugins and themes are one of the most common ways small sites get into trouble. WordPress's hardening guide is blunt: always keep up to date with the latest version.

• Plugins and themes: in Plugins > Installed Plugins, click Enable auto-updates next to each plugin you trust. Do the same in Appearance > Themes for the active theme.
• WordPress core: minor security releases install automatically by default. Our WordPress update checklist covers major updates, WP-CLI commands and how to roll back.
• Remove what you do not use: delete inactive plugins and themes. Deactivated code can still contain vulnerable files.
• Install only from trusted sources: the hardening guide recommends the WordPress.org directory or well-known companies.

Step 5: Harden WordPress settings

Turn off the built-in file editor

The dashboard has a theme and plugin file editor. If an attacker gets an administrator login, it lets them run code immediately. WordPress's hardening guide recommends switching it off. Add this line to wp-config.php, above the line that says to stop editing:

define( 'DISALLOW_FILE_EDIT', true );

Check file permissions

The hardening guide recommends 644 for files, 755 for directories, and 400 or 440 for wp-config.php. If you have SSH access, these commands, run from the WordPress folder, apply those values:

find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;
chmod 440 wp-config.php

Heads up: the right permissions can depend on how PHP runs on your server. If you are on shared hosting and unsure, ask your host before changing them, and take a backup first.

Step 6: Put a firewall in front of the site

A web application firewall (WAF) inspects incoming requests and blocks known attack patterns before they reach WordPress. You have three layers to choose from, and they can be combined.

Server level: ModSecurity in cPanel

Many cPanel hosts include ModSecurity. In cPanel, open ModSecurity in the Security section. cPanel's documentation describes an Enable button for all domains and an On or Off toggle for each domain. It recommends keeping ModSecurity enabled for all domains and only disabling it while you troubleshoot a ModSecurity problem.

Cloud level: Cloudflare

If your DNS runs through Cloudflare, its documentation says users on the Free plan get the Cloudflare Free Managed Ruleset, which is deployed by default and protects against high-impact, widely exploited vulnerabilities. Paid plans add the broader Cloudflare Managed Ruleset, and Cloudflare recommends enabling the rules tagged for your technology, such as wordpress. To turn it on, go to the Security Settings page in the Cloudflare dashboard and turn on Cloudflare managed ruleset.

Application level: a security plugin

Several WordPress security plugins include their own firewall. They are useful on hosts without ModSecurity, but they run inside WordPress, so server or cloud firewalls stop bad traffic earlier.

Step 7: Back up with an off-site copy

Backups are your last line of defence. A copy stored on the same server can be lost with it, so keep at least one copy somewhere else. In cPanel, the full backup tool can send the file to a remote FTP server or over Secure Copy (SCP) instead of your home directory. Our Fujairah resilience guide walks through the 3-2-1 backup idea, automatic remote backups and a restore test.

Step 8: Turn on logging and monitoring

Logs answer the question everyone asks after an incident: what happened, and when? WordPress's hardening guide recommends logging so you can track changes and spot intrusions.

• WordPress activity log: the free Simple History plugin records logins, failed logins, plugin installs and updates, post edits and user profile changes. At the time of writing it lists more than 300,000 active installations. You can view the log from a dashboard widget or its own admin page, and it can send a weekly email summary.
• Hosting logs: your control panel's access and error logs show requests and PHP errors. Download them if you suspect a problem, because many hosts rotate them after a short period.
• Uptime monitoring: a free external monitor that checks your homepage every few minutes and emails you when it fails.

Quick tip: once a month, spend five minutes scanning the activity log for logins at strange hours, new administrator accounts or plugins you did not install.

Your incident checklist

Print this and keep it with your backup details. If you suspect a breach, work through it in order.

1. Contain

Put the site into maintenance mode or ask your host to suspend it temporarily. Change the passwords for hosting, WordPress administrators, the database, FTP and email. Log everyone out of WordPress by replacing the security keys in wp-config.php. If you use WP-CLI, this does it in one step:

wp config shuffle-salts

2. Preserve evidence

Download the access logs, error logs and the Simple History log before anything is restored, so you can work out what happened.

3. Clean and restore

Restore the most recent backup from before the problem started, then update WordPress, every plugin and every theme straight away. Check Users > All Users for accounts you do not recognise.

4. Assess the data impact

Work out whether personal data could have been seen, changed or taken, and whose. Then check your notification obligations under the PDPL, the ADGM regulations or your sector rules with your adviser or the relevant regulator. Do this early, because obligations can have deadlines.

5. Communicate and review

Tell affected customers clearly what happened and what you are doing, where that is required or sensible. Afterwards, write down the cause and the fix, and add any missing step to this guide's checklist.

How to check your hardening worked

• 2FA: log out and back in to cPanel and WordPress. Both should ask for a six-digit code.
• Accounts: Users > All Users shows only current people, with no more than two administrators.
• File editor: the Theme File Editor and Plugin File Editor no longer appear in the dashboard menus.
• Updates: the Plugins screen shows auto-updates enabled for your plugins.
• Firewall: ModSecurity shows as on for your domains, or Cloudflare's Security dashboard shows managed rules active.
• Logging: Simple History shows your own recent login.
• Backup: restore one file or a database copy to prove the backup works.

Troubleshooting

Locked out of WordPress after enabling 2FA

Use one of your backup codes. If you have none, open your hosting file manager and rename the two-factor folder inside wp-content/plugins. WordPress deactivates a plugin whose folder it cannot find, so you can log in, rename it back and set 2FA up again.

Lost the phone used for cPanel 2FA

cPanel's documentation says to contact your hosting provider so they can disable 2FA on your account. Set it up again on the new phone immediately.

A form or page shows 403 Forbidden after enabling ModSecurity

A firewall rule may be blocking a legitimate request. Turn ModSecurity off for that one domain briefly to confirm, then turn it back on and ask your host to adjust the specific rule rather than leaving it off.

The site shows errors after changing file permissions

The server may need different permissions from the defaults. Restore the previous permissions from your backup or ask your host which values the server expects.

A plugin broke after an automatic update

Restore the previous version from your backup, disable auto-updates for that plugin only, and report the problem to its developer. Keep auto-updates on for everything else.

Cloudflare blocks your own admin actions

Check the security events log in the Cloudflare dashboard to see which rule fired, then create a narrow exception for that path rather than disabling the ruleset.

The one message worth forwarding

Send this to whoever manages your website:

"Please confirm, within the next week: 2FA is on for hosting, WordPress, the registrar and email; old user accounts are removed and we have no more than two administrators; plugins and themes auto-update; the file editor is disabled; a firewall is active; backups are copied off the server and a restore has been tested; activity logging is on; and our privacy notice matches the data our forms actually collect."

The takeaway: in Abu Dhabi, as anywhere in the UAE, a compliant website is a secure website first, so know your rules, collect less, lock every door and rehearse what you will do if one gives way.