When you build a house, you put a lock on the door and a latch on the window. Nobody calls that paranoia, it’s common sense. Websites are the same, except the burglars are bots and they try every door at once, around the clock.
No website is completely attack-proof. The only 100% secure site is one that’s offline. The good news is that most hacks aren’t clever. They exploit the same basic mistakes again and again. Fix those and you’re already ahead of most sites.
We’ll focus on WordPress because it runs a large share of the world’s websites, which is exactly why it’s the attackers’ favourite target.
1. Update core, plugins and theme
Vulnerabilities are found all the time in WordPress itself and in plugins and themes. The fix ships in a new version. If you don’t update, the hole stays open, and it’s now public knowledge. Bots look for exactly those versions.
WordPress installs minor security fixes on its own; bigger updates need a human. Update regularly, but not blindly: backup first, then update, then check that forms, the shop and the design still work.
And delete plugins you don’t use. A deactivated plugin is still on the server, vulnerabilities included.
2. Strong passwords and two-factor login
The site’s tech can be state of the art, but if one user’s password is Peter123, none of it matters. Password guessing is cheap and automated.
- Use a password manager and let it generate a long random password.
- Turn on two-factor authentication (2FA), at least for every administrator.
- Limit failed login attempts so a bot can’t try thousands of combinations.
- Don’t use “admin” as a username, and give each person only the permissions they actually need.
3. Backups that are encrypted and actually restorable
A backup is your last line of defence. When everything else fails, you roll the site back to yesterday and carry on. Three rules:
- Automatic and regular. Manual backups get forgotten.
- Off the server and encrypted. If the server is compromised, so are the backups on it.
- Tested. A backup that has never been restored is a hope, not a plan.
4. A security plugin as a watchdog
A good security plugin adds an application firewall, blocks suspicious IPs, tracks file changes and alerts you when something’s wrong. Some can also hide the login URL and change the database prefix so generic attacks don’t work.
Choose carefully. Five stars and zero reviews prove nothing. Check active installs, when it was last updated and whether a real company stands behind it. A security plugin that isn’t maintained is a security risk itself.
5. The basics: clean computer, good hosting, healthy scepticism
The strongest protection is useless if you log in from an infected computer or reply to a “your account has been suspended” email. Keep your computer and browser updated, and don’t click links that create a sense of urgency.
Choose hosting with a current PHP version, automatic backups and a human who answers when things break. The cheapest plan isn’t cheap if your site is down for a week.
In short
Security isn’t a one-off project, it’s a habit: update, back up, check, repeat. If you don’t have time for that every month, hand it over. All of my website maintenance plans include updates, backups and security monitoring. If you want to know how open your doors are right now, write to me.
If your site has already been hacked or is spreading malware, start with a hacked website cleanup.
Read next: Website maintenance: who actually needs it.
