Start with the thing that reframes this whole subject: your website is almost certainly not being targeted by a person. It is being scanned by software that crawls the entire internet looking for known, published vulnerabilities — the same ones on every site running the same out-of-date plugin.
That is genuinely good news. It means the defences that work are boring, cheap and mostly one-time. You are not trying to outwit an adversary; you are trying not to be the unlocked door.
The essentials — do these first
1. A valid certificate, and only one version of your site
Four things to confirm:
- Your address starts with https and the browser shows no warning.
- The certificate is valid for your domain, including the
wwwversion if you use it. - It has more than 30 days left. Certificates expire silently and then put a full-page warning in front of every single visitor.
- The http address redirects to https, rather than serving an unencrypted copy alongside it.
That last point is the one usually missed. Certificates from Let's Encrypt are free and renew automatically on most hosting; if yours does not, that is a question worth asking your host today.
2. Update everything, and delete what you are not using
Out-of-date software is how the overwhelming majority of small business sites get compromised. Not clever attacks — a plugin with a publicly documented hole that was patched eighteen months ago.
Two habits:
- Apply updates to your platform, theme and plugins. Turn on automatic updates for security releases if your platform offers it.
- Delete what you do not use. A deactivated plugin is still files on your server, and a deactivated plugin can still be exploitable. Deactivated is not removed.
The riskiest thing on most sites is a plugin the developer abandoned three years ago. If something has not been updated by its author in over a year, start looking for a replacement.
3. Take backups, and test restoring one
Backups are the thing that turns a catastrophe into a bad afternoon.
- Stored somewhere other than the server they back up. A backup on the compromised machine is compromised too.
- Covering files and the database. Either alone is half a website.
- Restored once, deliberately, as a test.
That last one is skipped essentially always, and it is the only one that proves the other two worked.
4. Fix your logins
Automated attacks guess passwords at enormous scale. Three things stop this cold:
- Long, unique passwords — from a password manager, never reused from another site.
- Two-factor authentication on every administrator account. This alone defeats password guessing entirely.
- No account called "admin", and no accounts belonging to people who left. An old employee's administrator login is a live key.
Also: give people the least access they need. A person who writes blog posts does not need the ability to install software.
The next tier — worth a conversation with your web person
5. Stop advertising which software you run
Many sites announce their platform and its exact version in the page or in the headers the server sends. That turns a broad internet-wide scan into a precise match: "this site runs the version with the known hole".
Removing it is not real security on its own — it is not lying to an attacker who checks properly. But it takes you out of the automated results, and the automated results are where the risk actually is.
6. Add security headers
Short instructions your server sends with each page. They cost nothing and take minutes:
- Strict-Transport-Security — tells browsers to only ever connect to you encrypted, so the insecure version can never be reached even once.
- X-Content-Type-Options: nosniff — stops the browser guessing what a file is, which is how an uploaded image ends up executed as a script.
- X-Frame-Options — stops your site being loaded invisibly inside somebody else's page to trick visitors into clicking things.
- Referrer-Policy — controls how much of your URL is passed to sites you link to.
- Content-Security-Policy — the strongest of the set and the fiddliest to configure. Worth doing properly rather than quickly.
7. Protect your forms
Any form that emails you, or writes to a database, will be found by spam bots. Without protection you get hundreds of junk submissions and eventually stop reading any of them — which is how a real enquiry gets missed.
Use a proper anti-spam measure. And confirm the form still delivers after you add it: over-aggressive protection silently eating real enquiries is a worse outcome than the spam.
8. Lock down file permissions and uploads
A conversation for whoever manages the server, but two specifics worth naming: configuration files should not be readable from the web, and a form that lets visitors upload files must restrict what types it accepts. An upload field that accepts anything is a way to put a program on your server.
The things people worry about in the wrong order
A security plugin is not a substitute for updates
Useful as an extra layer. Not a replacement for patching, and a site with a security plugin and eleven outdated plugins is not a protected site.
"We're too small to be hacked" is the belief that gets sites hacked
Scanners do not check your turnover. A compromised small site is worth the same generic things as any other: spam relay, phishing host, a place to inject links.
Being hacked costs you rankings as well as a clean-up
Google flags compromised sites in search results and, in browsers, with a full-page red warning. Recovering the rankings takes far longer than removing the malware.
The short version
- Valid certificate, http redirecting to https, renewal automatic.
- Everything updated. Everything unused deleted.
- Off-site backups, tested once.
- Two-factor authentication on every admin account; old accounts removed.
- Security headers added.
- Version numbers off display.
- Forms protected — and still delivering.
Items one to four are the ones that matter. If you only ever do four things, do those, and you will have closed off nearly everything that actually happens to sites this size.