Website security and GDPR compliance in Lyon — Protect your site and your customers

Website security in 2026: an obligation, not an option

The cyberattacks that target small businesses

The most common attacks on small-business websites are phishing (fake emails urging people to click a malicious link), SQL injection (abusing forms to reach the database), brute force (mass login attempts on the admin area), ransomware (your data is encrypted and a ransom demanded) and defacement (your site is replaced by the hacker's message). Every day, more than 30,000 websites are hacked worldwide — most of them belong to small organisations.

The average cost of a cyberattack for an SME

The average cost of a cyberattack for a French SME is estimated at between €25,000 and €50,000, including lost business, data restoration, legal fees, reputational damage and lost customers. For a very small business, a single attack can be fatal. Investing in preventive security is far more cost-effective than managing the crisis after an attack.

HTTPS, SSL certificates and Google trust signals

HTTPS (via an SSL certificate) encrypts the exchanges between your visitors' browsers and your server. Since 2018, Google Chrome has displayed a “Not secure” warning on HTTP sites. It has also been an SEO ranking factor since 2014. Every site we build is delivered with an active, automatically renewed SSL certificate. See also our EAA compliance and web accessibility service.

Our website security audit

Vulnerability scan

Automated and manual analysis of your site for known flaws: outdated CMS and plugin versions, vulnerable JavaScript libraries, exposed endpoints and risky server configurations.

Injection and XSS testing

Manual testing of forms and URL parameters to detect SQL injection and cross-site scripting (XSS) vulnerabilities. These flaws let hackers access your data or inject malicious code into your pages.

Access and server log review

Review of admin accounts, permission levels and server logs to detect suspicious logins or past intrusion attempts.

File permission checks

Audit of file and folder permissions on the server to make sure no sensitive file is publicly accessible and that permissions follow the principle of least privilege.

Report and remediation plan

A full report with every vulnerability ranked by severity, together with a prioritised remediation plan. Add a full website audit for a 360° view.

GDPR compliance for your website

Mandatory legal notice

Drafting or updating your legal notice in line with the French Law for Confidence in the Digital Economy (LCEN). Publisher identity, hosting provider, publication director, terms of use — everything is covered.

A compliant privacy policy

Drafting a complete, GDPR-compliant privacy policy: types of data collected, purposes of processing, retention periods, users' rights (access, rectification, erasure, portability) and the data controller's contact details.

Cookie banner and consent management

Setting up a cookie banner that follows the recommendations of the CNIL (the French data protection authority), with granular consent management by category (necessary, analytics, marketing, social media). We use recognised solutions such as Axeptio, Cookiebot or Tarteaucitron, depending on your preference.

GDPR-ready forms

Checking all your forms and bringing them into compliance: statement of the purpose of processing, link to the privacy policy, explicit consent for marketing communications and data minimisation.

Record of processing activities

Creating your record of processing activities (mandatory for companies with more than 250 employees and recommended for every organisation): description of processing, data categories, recipients, transfers outside the EU and security measures.

Outsourced DPO: our recommendations

For organisations that need a Data Protection Officer (DPO) but cannot hire one in-house, we refer you to trusted outsourced DPOs in the Lyon area.

Our ongoing protection measures

Configuration hardening

We reduce your site's attack surface: administrator accounts kept to the strict minimum, strong passwords, limits on back-office login attempts, HTTP security headers and unused features switched off. These settings limit the risk of injection, brute force and exploitation of known flaws.

Two-factor authentication (2FA)

Two-factor authentication on every administrator account on your site. Even if a password is compromised, the attacker cannot log in without the second factor (SMS code or authenticator app).

Security updates as soon as they are released

Security updates are applied as soon as they are released. We monitor the security bulletins for every component used on your site. Explore our maintenance contracts for continuous protection.

Uptime and file monitoring

Automated monitoring checks your site's availability every 60 seconds, and regular scans detect any unauthorised change to its files. In the event of an intrusion, we step in as a priority, the same working day (Monday to Friday, 9 am to 7 pm), to isolate the threat and restore the site.

Daily backups

Your site's files and database are backed up every day. In the event of a hack, an error or an outage, we restore a clean version of your site from these backups.