Your Website Is Your Business — Treat It Like One
Your author website is not a vanity project. It is the front door of your publishing business — the place readers find you, sign up for your newsletter, and purchase your books directly. It hosts your email sign-up forms, your mailing list infrastructure, your contact information, and often your social proof.
Most authors spend significant time crafting the copy and design of their website, and almost no time on the underlying security and legal infrastructure that keeps it functional and compliant. The consequences of neglecting that infrastructure can range from an embarrassing outage during a launch to a compromised website spreading malware to your readers, to a regulatory complaint about data privacy practices.
None of this is technically complicated for a typical author website. But it does require knowing what to check and what to fix.
Own Your Domain — Verify It
The Most Important Rule
Your domain name — yourname.com, yourbookseriesname.com — is yours. Or it should be. Many authors discover, often at a painful moment (a website redesign, a designer relationship gone bad, a hosting migration), that their domain is actually registered to their web designer, developer, or an agency.
A domain registered to someone else is not your domain. It belongs to whoever's name is on the registration. They can refuse to transfer it. They can let it lapse. They can hold it hostage.
How to check: use Whois.com or ICANN Lookup to search your domain. The Registrant contact should be you — your name, your email address. If it isn't, this needs to be corrected immediately.
Transferring Your Domain
If your domain is currently registered to someone else (a designer or agency who built your site), you need to request a transfer to a registrar account in your own name. The process: ask them to initiate an outgoing transfer, accept the transfer invitation, and complete it through your chosen registrar (GoDaddy, Namecheap, Google Domains, Cloudflare are all reliable options). Most transfers complete within 5–7 days.
If the person holding your domain refuses to cooperate, escalate to the registrar's abuse department. Holding a client's domain hostage is a violation of ICANN policies and registrar terms of service.
Auto-Renewal and Multi-Year Registration
The single most common cause of author websites going offline is a domain that expired because auto-renewal was turned off or a credit card on file expired. Set your domain to auto-renew. Register for multiple years (2–5 years) as extra insurance. Put a calendar reminder 60 days before renewal regardless.
An expired domain is a bad situation even if it's quickly recovered — it can take 48–72 hours for DNS to propagate after a domain is recovered, during which your website and email don't work. During a book launch, this is catastrophic.
SSL Certificates — The Padlock
Every author website must have HTTPS — the encrypted connection indicated by the padlock icon in browsers. Without it:
Browsers display security warnings to visitors, telling them the site is "not secure"
Google deprioritizes non-HTTPS sites in search rankings
Form submissions (newsletter sign-ups) are transmitted unencrypted, which is a privacy problem and a GDPR compliance issue
SSL certificates are no longer expensive or complicated. Most hosting providers (Bluehost, SiteGround, WP Engine, Cloudflare) provide free SSL certificates through Let's Encrypt, installed with a single click. If your site doesn't have HTTPS, contact your hosting provider today — it is typically a five-minute fix.
Hosting Account Security
Your hosting account — where your website files live — is the master access point for your entire website. If it's compromised, an attacker can replace your website with anything they choose, including malware that infects your readers' computers.
Enable two-factor authentication (2FA) on your hosting account immediately if it isn't already active — most major hosts offer this in account settings
Use a strong, unique password for your hosting account — not the same password you use elsewhere
Never share your hosting account credentials with contractors. Instead, create a separate FTP or cPanel account with limited access for anyone who needs to work on the site
If you change web designers or hosting managers, change your password and revoke their access immediately after the transition
Website Backups
If your website is hacked, corrupted, or accidentally deleted, the difference between a 30-minute recovery and a complete rebuild is whether you have a recent backup.
Backup frequency: at minimum weekly automated backups; daily if you update your site frequently
Backup storage: keep backups in at least two locations — your hosting provider's backup system AND an off-site location (cloud storage like Dropbox or Google Drive, or a separate backup service like BlogVault or UpdraftPlus for WordPress)
Test your backups periodically — a backup you've never tested may not restore correctly when you need it
Retain at least 30 days of backup history so you can restore from before a problem occurred rather than to a version that includes the problem
WordPress-Specific Risks
If your author website runs on WordPress (most do), specific security practices matter:
Update WordPress core, themes, and plugins promptly when updates are available — outdated components are the most common hack vector for WordPress sites
Remove unused plugins and themes — every plugin is a potential security surface, and inactive plugins are often the first to go unpatched
Use a security plugin (Wordfence, Sucuri) that provides firewall protection, login attempt limiting, and malware scanning
Change your WordPress admin username from the default "admin" to something unique
Privacy Policy — The Legal Requirement
If your author website collects email addresses OR uses Google Analytics, Facebook Pixel, or any other tracking technology, you are required by GDPR (and by many US state privacy laws) to have a privacy policy that discloses your data practices.
What the privacy policy must cover:
What personal data you collect (email addresses, names, IP addresses)
Why you collect it and your legal basis for doing so
Who you share it with (your email marketing platform, your analytics provider, any advertising tools)
How long you retain it
How visitors can request access to their data or deletion
Your contact information for privacy inquiries
Free privacy policy generators — Termly, iubenda, and PrivacyPolicies.com — can generate a GDPR-compliant policy for a typical author website in about 15 minutes. Link it from your website footer and from every sign-up form.
Cookie Consent
EU privacy law (GDPR and the ePrivacy Directive) requires that you obtain consent from EU visitors before placing non-essential cookies on their devices. If your site uses Google Analytics, Facebook Pixel, or similar tracking technologies, you need a cookie consent banner.
WordPress plugins that handle this: Complianz, GDPR Cookie Consent, and Cookiebot all provide compliant cookie consent management. For non-WordPress sites, Cookiebot and CookiePro offer platform-agnostic solutions.
The consent banner must allow visitors to accept or reject cookies, not just acknowledge them. A banner that only says "we use cookies" without giving users a choice is not compliant.
ScribeCount Author OS:
Website Traffic Integration
ScribeCount's Website
Traffic module shows you where visitors to your author website come from and
what they do when they arrive — making website performance directly visible as
a business metric. When your website has proper SSL, regular backups, and
current security practices, it stays online and functional during the moments
that matter most: book launches, promotions, and media appearances. The privacy
policy and cookie consent requirements described in this article are also
prerequisites for using advertising tools and analytics platforms that feed
into ScribeCount's tracking — compliant data collection produces better data.
Conclusion
Your author website doesn't need to be technically complex to be secure. It needs: a domain registered to you, HTTPS, two-factor authentication on your hosting account, regular backups, current software if you use WordPress, and a privacy policy.
Set aside an afternoon to work through this list. Most items take under 30 minutes to implement. The cumulative protection they provide — against hackers, domain loss, data loss, and regulatory complaints — is significant.
Then go write. Your website security should require zero of your attention once it's properly set up.
- Randall