Your website does a lot of heavy lifting. It's where patrons discover your programme, book tickets and sign up for news. It also holds their personal details. That makes it worth protecting, whether you run a national museum or a small community arts centre.

So what are you actually protecting it from? You don't need to become a security expert to find out. We'll walk you through three of the biggest threats websites face today: attacks sped up by AI, people trying to break in, and floods of unwanted automated traffic. For each one, we'll explain what we do to keep your venue safe.

AI hasn't only changed how we write and design. It's changed how cyber attackers work too. The same tools that help developers write code can help criminals read it, hunting for vulnerabilities far faster than any person could.

The biggest worry is something called a zero-day vulnerability. That's a weakness in a piece of software that nobody has spotted yet, including the people who made it. And because nobody knows it's there, there's no fix for it. Finding one used to take skill, patience and a fair bit of luck. Now attackers can point AI at huge amounts of software and turn up weak points much more quickly.

What does that mean for you? Put simply, websites are being probed more often, and more cleverly, than ever. We tackle this in two ways: looking after the software we use from other companies, and building security into the software we write ourselves.

Most websites are built partly from ready-made parts made by other companies: the CMS*, plugins, payment modules and code libraries. Think of them as the locks, hinges and windows that come with a building. When someone finds a weakness in one of them, the maker releases an update, called a patch, to close the gap.

The risky bit is the time between a patch being released and it being installed. Once a fix is public, attackers know exactly where to look, and AI helps them find sites that haven't updated yet.

So we keep third-party software on your website patched and on supported versions as new releases come out. It's not the most glamorous part of our job. But it's one of the most effective things anyone can do to keep a website safe.

* And about your CMS: It is built and owned by CultureSuite, with a unique focus on the cultural sector, but it does use third party frameworks, and libraries for core functionality.

With the code we write ourselves, we don't have to sit and wait. We build protection in at every stage.

Every change gets reviewed. Before new code goes live, our developers check it, and so do AI review tools. Each catches things the other can miss. Our team knows the classic attack techniques well. Take SQL injection, where an attacker types database commands into a form field to read or change your data. Or cross-site scripting, where someone slips harmful code onto a page so it runs in your website visitors' browsers.

We use AI the way attackers do, only sooner. If AI can find weaknesses, we'd rather it found them for us. So we point the same kind of tools at our own work while it's still being designed and built. A problem caught at that stage is cheaper to fix, and it never becomes a risk to you or your patrons.

Security audits are built in. Automated checks run as part of our development process. That means every project is tested for known weaknesses regularly, not just once at launch.

We make it easy to tell us about problems. Your website comes with a security.txt file, a small, standard file that tells security researchers how to report something they've found. We pair it with bug bounties: rewards for people who report weaknesses responsibly instead of exploiting them. The result? More friendly eyes looking for problems, and a clear route for them to reach us.

Not every attack depends on a hidden flaw in the code. Plenty of attackers simply try the front door. They guess passwords, use login details stolen from somewhere else, or look for routes into your data that were left open. Our approach is straightforward: strong doors, the right keys for the right people, and regular checks on the locks.

A limit on login attempts. Attackers often use software that tries thousands of passwords one after another. We cap the number of failed attempts, so that kind of guessing quickly hits a wall.

Two-factor authentication. Logging into your CMS, where you edit your website, takes a second step as well as a password. That's a code sent to your email address. So even if someone steals a password, it isn't enough on its own.

Single sign-on. Why juggle yet another password? Your team can log in with the work account they already use, through Google or Microsoft Entra. Those accounts come with strong protection built in. And when someone leaves your organisation, closing their main account closes their access to your website too. Our own team, from support to sales, logs in through Keycloak, a dedicated login system that lets us manage and keep an eye on staff access in one place.

Roles and permissions. Not everyone needs access to everything. Our support team has access to your live CMS to support and investigate issues, while other teams may have limited access to provide insights about module usage, without exposing any sensitive data.

Anonymised data. When the real details aren't needed, for example while developing, testing or troubleshooting, we work with anonymised data. Names, email addresses and other personal information are removed or swapped out, so there's nothing valuable exposed.

Locked-down connections between systems. Your website often talks to other systems, such as your CRM, through an API. Think of it as a doorway that lets software swap data automatically. We control who and what can use those doorways. For systems like your CRM, we use layered permissions, so each connection can only reach the specific data it needs.

How do you know the locks actually work? You try to pick them. A penetration test, or pen test, is a controlled, authorised attack on your website by security specialists. They try to break in the way a real attacker would, then report what they found so it can be fixed. We welcome them. And if your venue wants to commission its own independent test, we'll support it, giving the testers what they need and acting on the results.

Technology only gets you so far. Plenty of breaches start with a person: a password sent by email, or a laptop left on a train. That's why everyone on our team, from support to sales, follows clear rules.

Who's actually visiting your website? A surprising share of your website visitors aren't people at all. They're bots: automated programs that visit pages on their own. Some are helpful, like the ones search engines use to list your site. Others copy your content, hunt for weaknesses, or send so many requests that real patrons can't get through. And a growing number are AI crawlers, gathering content to train AI systems and sometimes hitting a site far harder than it was built to handle.

The result? A slow website, a site that goes offline, or higher hosting costs, often at the worst possible moment. Here's how we keep that traffic in check.

Protection from DDoS attacks. In a DDoS (distributed denial-of-service) attack, thousands of machines bombard a website at once to knock it offline. We use DDoS protection from Bunny, a European provider whose network absorbs and filters this traffic before it reaches your site.

A brake on AI crawlers. We throttle AI bots. That means we slow them down and cap how many requests they can make, so they can't overload your site or eat up its resources. This is a fairly standard procedure that forces AI crawlers to slow down, without blocking them from access to content they need.

A queue for the big moments. A new exhibition opening? Tickets for a popular show going on sale? When a genuine rush hits, website visitors join a short, orderly queue rather than the site buckling under the pressure. Everyone gets their turn, and the site stays up.

And when the queue is active, we use an allow list for traffic that will not be queued. This is a list of bots we know and trust, like the major search engines. Anyone not on that list is not getting in.

No website can ever be 100% secure, and anyone who promises otherwise isn't being straight with you. What makes the difference is having several layers of protection, keeping them up to date and testing them regularly. If one layer misses something, the next one catches it.

You can play your part too. Switch on two-factor authentication wherever it's offered. Use a password manager. Give your team only the access they need. And when someone leaves, remove their access.

Our safeguards do most of the work, but a few habits on your side make a real difference.