In Germany, website security is not just a technical task for the IT department but a legal obligation under Article 32 GDPR; the recommendations of the Federal Office for Information Security (BSI) serve as a practical guide.

Mandatory HTTPS for all business websites

Any website that has even a simple contact form or transmits personal data must use current encryption: TLS 1.3 (or at least TLS 1.2). Using outdated protocols such as SSL 3.0 or TLS 1.0, or transmitting data over unencrypted HTTP, can lead to action by the supervisory authorities.

Essential HTTP security headers

A modern security audit requires correctly configured headers on the web server: Strict-Transport-Security (HSTS with redirection to HTTPS); Content-Security-Policy (CSP to block injected malicious scripts, XSS); X-Frame-Options (protection against clickjacking and embedding the site in frames); and X-Content-Type-Options: nosniff.

Protecting admin panels and two-factor authentication

Brute-force attacks on CMS admin panels (WordPress, Webflow, Shopify) remain one of the main ways sites are compromised. Access to the site's management system must be protected by two-factor authentication (2FA), a limit on login attempts and, where possible, an IP allowlist.

Regular vulnerability scanning and backups

Businesses need a defined procedure for automatic backups, with archives stored on isolated servers separate from the main hosting. Regular updates to the CMS, plugins and server libraries prevent attackers from exploiting known vulnerabilities (CVEs).

What to check

  • Check your TLS configuration for an “A+” rating on SSL Labs.
  • Configure the HSTS, CSP and X-Frame-Options security headers on the web server.
  • Make two-factor authentication mandatory for all site administrators.
  • Set up daily encrypted backups of the database and media files.

Example situation

An online shop set up a Content-Security-Policy and HSTS, preventing an attempt to steal payment data through a vulnerable third-party widget and confirming the system's reliability in an external security review.

Next step

A technical security audit based on BSI recommendations protects a business website from attacks, keeps the business running and helps you comply with European law.

Official information on this topic

Checklists and examples are organisational recommendations. Requirements depend on the procedure, the city and your situation; check them with the relevant office before you act. Please discuss legal and tax questions with an authorised professional.

This article was prepared with the help of AI. The example illustrates the approach and does not describe a client case.