How to Keep Your Website Secure

Small websites are not too small to be attacked. Most attacks are automated, scanning the web for known weaknesses rather than targeting specific businesses. The good news is that a handful of habits block the majority of them.

Keep software updated

Outdated platforms, themes, and plugins are the most common way sites get compromised. Apply updates promptly for your content management system, extensions, and any libraries. Enable automatic updates for security fixes where practical, and take a backup first.

Remove what you do not use

Every plugin, theme, and account is a potential weak spot. Delete unused ones rather than just deactivating them. Choose well-maintained, reputable extensions with recent updates.

Use strong, unique passwords

Use a password manager to create long, unique passwords for your hosting, CMS, domain registrar, and email. Never reuse passwords across services. Change default usernames such as "admin" where possible.

Turn on two-factor authentication

Two-factor authentication (2FA) adds a second step to logins, such as a code from an app. Enable it on your hosting account, domain registrar, website admin, and email. It blocks most account takeovers even when passwords leak.

Limit access

Give each person their own account with only the permissions they need. Remove access immediately when someone leaves or a contractor finishes. Avoid sharing logins.

Use HTTPS everywhere

Encrypting traffic protects visitors and logins. See SSL and HTTPS.

Back up regularly

Backups let you recover if something goes wrong. Keep copies off-site and test restores. See website backups.

Choose secure hosting

Look for providers offering firewalls, malware scanning, isolated accounts, and prompt patching. See how to choose web hosting.

Protect forms and logins

Use spam protection and limit login attempts to slow brute-force attacks. Validate form input on the server. See contact form design.

Add a web application firewall

A firewall, often available through hosting or a CDN, filters malicious traffic before it reaches your site.

Monitor and scan

Use uptime monitoring and malware scanning, and watch for unexpected changes, new admin users, or sudden traffic spikes. Google Search Console may alert you to security issues. See Search Console setup.

Keep sensitive files private

Do not leave backups, configuration files, or database dumps in publicly accessible folders. Remember that robots.txt is not security.

Protect your domain

Lock your domain at the registrar, secure the registrar account, and keep contact details current. Losing control of your domain can be worse than a hacked site.

Have a response plan

Know who to call and what to do if your site is compromised: take it offline if needed, change all passwords, restore from a clean backup, update everything, and investigate how the intruder got in.

Be careful with data

If you collect personal data, store as little as you need and know your legal obligations. See privacy policy and cookie banner basics.

The bottom line

Update everything, use strong passwords and 2FA, limit access, and keep tested backups. These basics stop most real-world attacks. Add them to your maintenance checklist.