Security is always the trade off, and I don't have any good answers to that problem (aside regular maintenance).
The websites I'm thinking about, though, tended to be marketing websites ('microsites') for large consumer brands, that really didn't do a great deal functionally, and didn't need particularly robust security in the grand scheme of things.
The websites I'm thinking about, though, tended to be marketing websites ('microsites') for large consumer brands, that really didn't do a great deal functionally, and didn't need particularly robust security in the grand scheme of things.