Website security basics every small business should follow

Attackers rarely pick a target; they scan the internet for easy ones. A few habits keep you off that list.

1. Use strong, unique passwords for hosting, your admin login and email. A password manager helps.
2. Turn on two-factor login wherever it is offered, especially for email and hosting.
3. Keep software updated. Outdated plugins and themes are the commonest way in.
4. Remove what you do not use: old plugins, test pages and unused admin accounts.
5. Use HTTPS across the whole site.
6. Back up regularly, and keep a copy off the server. Test that you can restore it.
7. Limit access. Give people only what they need, and remove access when someone leaves.
8. Watch for changes. Unexpected pages, redirects or emails sent from your domain are warning signs.

Be careful with files

Never upload files from sources you do not trust, and do not leave database backups or notes in public folders.

If your site is hacked

1. Change all passwords from a clean device.
2. Contact your hosting provider.
3. Restore from a clean backup.
4. Find and fix how they got in, or it will happen again.

See our Website Maintenance service.