Remediation Center

An audit usually finds more issues than a team can fix in a week. Fixing them in the right order cuts the most risk soonest. Here is the order we recommend for a website, with links to the guide behind each step.

Fix today: active risks

1. Security holes: patch exploited vulnerabilities, remove exposed admin panels and default passwords, and enable multi-factor authentication on admin accounts. See Security.
2. Data leaking without consent: stop analytics, advertising and social pixels from loading before consent. See Cookies & Consent.
3. Exposed personal data: public buckets, open directories, test databases online, data in URLs. If data was exposed, assess whether the 72-hour breach notification applies.

Fix this week: quick wins

1. Add a "Reject all" button to the first layer of the cookie banner.
2. Update the privacy policy so it lists the tools the site actually uses.
3. Make the order button say the customer will pay, and show total prices with all fees (Consumer Protection).
4. Add unsubscribe links to every marketing email (Email Compliance).
5. Fix the most common accessibility failures: missing alt text, unlabelled form fields, low contrast, no visible focus.
6. Self-host fonts and scripts that send visitor data to third parties.

Fix this month: processes

1. Sign data processing agreements with every processor and document transfers (Third-Party Services).
2. Write your records of processing and a breach response plan (Reports).
3. Set up a channel and a procedure for data subject requests.
4. Review your terms of service for unfair clauses.
5. Publish how you verify reviews, and an accessibility statement.
6. Start a register of licensed assets.

Keep it fixed

• Re-check the website after every release: new tags, plugins and forms are where problems come back.
• Give each area an owner and review it every quarter.
• Keep the evidence of each fix with its date. It is your best answer to a regulator.

This guide is general information about EU rules, not legal advice. Requirements can differ by country and by business: check with your data protection authority or a lawyer for your case.