Cybersecurity for businesses: how to secure your website

On 27 October 2026, the Norwegian National Security Authority (NSM) raised the national cyber risk level from "moderate" to "high". That's the second-highest step on the scale, and the first time NSM has published the level instead of classifying it. The message to Norwegian businesses is short: act now. For most businesses, cybersecurity starts with the website. It's the first thing an attacker sees, and the one most likely to be running software nobody has updated.

This article explains what the warning means, and what you should do about your website this week.

What NSM announced on 27 October

NSM's scale has five steps: very low, low, moderate, high and extremely high. "Moderate" is treated as the normal state online, where attacks against Norwegian businesses happen all the time. The level is now one notch above normal.

NSM gives three reasons. The number of successful cyber operations against Norwegian organisations has tripled over the past year. AI makes it quicker and easier to find and exploit vulnerabilities. Attackers also have a fresh example to practise on: the critical PHP vulnerability php2shell, fixed the week before.

NSM's director says businesses now have hours, not days or weeks, to close known security holes. The expectation is that measures go in immediately.

NKOM, the authority that regulates telecoms and data centre operators, followed up the same day, but only for its own sector. It is folding the measures into its security dialogue with the operators it regulates. For everyone else, NSM's measures are recommendations, not requirements. The mobile and broadband networks aren't affected. A raised risk level is about being prepared, not about something having already happened.

Why your website is the most exposed surface

Your website answers requests from the entire internet, around the clock. That makes it the easiest way in. An attacker doesn't need to steal a password or get onto the internal network first, because the site is already open to everyone. Automated scanners look constantly for servers running software with known holes.

php2shell shows why this is urgent. On a server set up with Apache and mod_php, the attack can run code before the site even loads. At that point it doesn't matter how well the code is written or how well your CMS is secured.

When we take over hosting for Norwegian websites, we find the same things again and again: PHP that hasn't been updated in years, extensions and libraries with known vulnerabilities, and a server nobody really owns. It might be a VPS a former supplier set up in 2019, a Docker image stuck on an old PHP version, or a campaign site on a subdomain everyone has forgotten. That's where break-ins start.

NSM's 21 measures, in practice

NSM leans on its own basic principles for ICT security and points to 21 measures that apply to every business. Most are about hygiene, not advanced attacks. The table below groups them into what they mean for you if you run a website.

The last point catches a lot of people out. A web host or hosting provider does much of the work, but only what you've agreed they'll do. Ask what the agreement actually covers.

How to secure your website

The order below is the one we follow ourselves. Step two is the one that's urgent this week.

1. Find out who hosts the website. If you're on a web host, it's the hosting provider that updates the server. If you don't know who runs the site, the knowledge base shows how to find out.
2. Update the server software now. Check that PHP has the fix for php2shell, and that your CMS, extensions and libraries are current. Here's how to check your PHP version, and the full write-up on php2shell.
3. Turn on two-factor everywhere. Start where it gives an attacker the most: your CMS login, the hosting account, SSH and the account that controls the domain and DNS.
4. Keep a backup you've tested restoring. A backup you've never tried to restore is an assumption. In a ransomware attack, a tested copy kept off the server is the difference between restoring and paying. Read more about ransomware.
5. Remove what you don't use. Old themes, extensions you've deactivated, forgotten subdomains and user accounts nobody logs into. Anything that runs can be attacked.
6. Turn on logging and alerting. You can't clean up something you never noticed. Collect logs off the server, so they don't disappear at the next deploy.
7. Have a plan for a break-in. Who takes the site offline, who tells the customers, and where's the backup? If you don't know where to look, we list the signs a site has been hacked.

Hours, not days

NSM says hours, not days. That's a fair expectation, but only if you've set hosting up to make it possible.

When php2shell was fixed on 21 October, we patched all of our own servers the same evening, at 18:57. It's quick because the servers are run the same way and from one place, not because someone worked fast that night. A security update goes through a CI/CD pipeline and is in production within minutes. Nobody logs into each server and uploads files over FTP.

What separates a server patched the same evening from one left open for weeks is that updates, monitoring and backups were in place before the warning came. We host in the EU/EEA with that setup, and we look for signs of a break-in once something has happened. There's more on the IT security page.

The rules are tightening

This isn't only about this week. The demands on security are rising whatever the risk level. The Digital Security Act, which brings the EU's NIS2 directive into Norwegian law, widens which businesses have to get a grip on exactly what NSM is now asking for. At the same time, more and more customers ask about your security routines in tenders. The sooner this is in place, the cheaper it is than sorting it out under pressure later.

Summary

• NSM raised the national cyber risk level to "high" on 27 October 2026, the second-highest step. Measures are urgent.
• Your website is the most exposed part of your setup. Updated server software is the most important thing you do, and for vulnerabilities like php2shell the security inside the site itself doesn't help.
• NSM's 21 measures come down to five things: update, two-factor, a backup you've tested, logging and a plan.
• Know who hosts the website. The responsibility is still yours, even when someone else does the work.