CMS Security Handbook: The Comprehensive Guide for WordPress®, Joomla!®, Drupal™, and Plone®

Building It Before You Build It

It has been my experience that people tend to get wrapped up in the details of the look and feel of a site, instead of how it works. Although the look and feel is very important, you should spend time designing the workflow of the site and system first.

For starters, here are some considerations about the functionality of your site:

• Will the end users need to, or be required to, register?
• Will the site automatically allow them to log in?
• What information will the end users need to provide?
• What will they do after they log in?
• What is the lost password policy?
• What features should the login have?
• What permissions or access will the users get?
• Will you have more than one administrator of the site?
• What will these administrator roles be?

As you can see, these are the detailed questions that do not involve the actual colors, pictures, or text on the site. They are designed to help you get the site workflow in place.

A low-tech (but effective) method to approach site planning is to lay out the functions on index cards and then list the potential third-party extensions (add-ons) that can fulfill those functions. If you settle on an add-on, record the URL, support information, or telephone number on the index card for future reference.

Additionally, take a look at the track record of the developer via the change logs to see a record of security fixes. If the developer has a lot of fixes, it could mean the company is proactive, and you may feel good about ...