Eight Craft CMS websites updated to pass Microsoft Defender security checks

A large international company runs eight Craft CMS websites for its brands, hosted on Azure. Its security team checks every site with Microsoft Defender. All eight were failing that security check, because they ran on Craft 3, which no longer gets safety fixes.

Craft 3 cannot jump straight to Craft 5. It has to go through Craft 4 first, so the update was a big one. Each site holds years of pages, files and user accounts, and staff use them every day. Nothing could be lost, and staff had to keep signing in as normal.

First I built a set of automatic checks for each site. They click through the pages, forms, downloads and sign-in, just as a person would. That gave a clear record of how each site should behave.

Next I practised each update on a copy of the live site, again and again, until it ran cleanly every time. Then each live site updated itself, so the work staff added that day was kept.

After each update, the same checks ran again and passed. Microsoft Defender had found over 600 errors across the sites, and every one is now solved. Every site now passes the security check and is far safer to run.