Many small business owners assume hackers wouldn't bother with their site. Unfortunately, most website attacks aren't personal. Automated tools scan the internet for known weaknesses, such as outdated plugins, weak passwords and abandoned admin accounts, and exploit whatever they find. Small sites get caught simply because they're easy.
The good news: a handful of basic habits prevent most common problems. Here's what we focus on when we take care of a client's site.
1. Keep everything updated
Outdated software is one of the most common ways sites get compromised. If your site runs on a content management system, that includes:
- The core platform
- Your theme
- Every plugin or extension
- Server software, if you manage your own hosting
Updates often include security fixes for publicly known vulnerabilities, which is exactly what automated attacks look for. Update regularly, but take a backup first and check the site afterward, because updates occasionally break things.
Remove what you don't use
Inactive plugins and themes can still be exploited. If you're not using it, delete it. Fewer moving parts means fewer things to update and fewer ways in.
2. Have backups you can actually restore
Backups are your safety net for hacks, bad updates, accidental deletions and hosting problems. A good backup setup has three qualities:
- Regular: frequent enough that you wouldn't lose much work.
- Off-site: stored somewhere other than your web server, so a server problem doesn't take your backups with it.
- Tested: you know a restore works because you've tried it.
Many hosts include backups, but check how often they run, how long they're kept and how restores work.
3. Lock down logins
Strong, unique passwords
Every account with access to your site, host, domain registrar and email should have a strong, unique password. A password manager makes this realistic.
Two-factor authentication
Turn on two-factor authentication wherever it's offered, especially for your hosting account, domain registrar and site admin.
Limit who has access
Review admin accounts regularly. Remove former employees, old contractors and anyone who no longer needs access. Give people the lowest level of access they need.
4. Use HTTPS everywhere
HTTPS encrypts traffic between visitors and your site and shows the padlock in the browser. Most hosts provide free certificates. Make sure your whole site uses HTTPS and that certificates renew automatically. Browsers display warnings on sites without it, and those warnings scare visitors away.
5. Watch for problems
Uptime monitoring
Monitoring tells you quickly when your site goes down, rather than finding out from a customer days later.
Malware scanning
Security scanners look for known malicious code and suspicious changes. Some hosts include scanning, and there are reputable plugins and services as well.
Forms and spam
Contact forms attract spam bots. Spam protection keeps your inbox usable and reduces abuse of your forms.
6. Protect your domain and email
Your domain is the foundation of your website and email. Keep registrar contact details current, enable auto-renew, and turn on registrar lock and two-factor authentication. Losing a domain to an expired card or a compromised registrar account can be far more disruptive than a website hack.
What to do if you think you've been hacked
Signs include unexpected redirects, strange new pages, browser or search engine warnings, emails from your host or sudden spam sent from your domain.
- Don't panic, and don't start deleting things randomly.
- Change passwords for your site, hosting, and related accounts.
- Contact your host. Many can help identify and contain the problem.
- Restore from a clean backup if you have one from before the problem started.
- Update everything and remove unused plugins so the same hole can't be reused.
- Check search engine tools for security warnings, and request a review once clean.
This is where good backups and monitoring pay for themselves: fast detection and a clean restore can turn a disaster into a short inconvenience.
A realistic routine
- Monthly: update software, confirm backups ran, run a security scan and review user accounts.
- Quarterly: test a backup restore and review who has access to what.
- Yearly: check domain renewal, registrar security and hosting fit.
Frequently asked questions
Is my hosting company responsible for security?
Partly. Hosts typically secure their servers, but your site's software, plugins, passwords and user accounts are usually your responsibility, or your maintenance provider's. Check what your host actually covers.
Do I need a paid security tool?
Not always. Updates, backups, strong logins and basic monitoring cover a lot. Paid tools can add value for busier or higher-risk sites.
How KeptWeb handles security
Security is part of every KeptWeb plan. We keep your software updated, run security and uptime checks, keep backups and send a monthly report so you know what was done. Learn more on our website security, updates and backups and website monitoring pages.
Plans start at $49/mo (Basic), with Growth at $99/mo and Pro at $149/mo, which add more small edits, blog posts and priority replies. They're month-to-month, and you can cancel anytime online or by email. $0 and discounted builds need a 12-month plan. Professional firms like accountants and attorneys often start here.
Not sure how your site stacks up? Ask for our free website review and we'll flag outdated software, missing backups and other risks. Or see our plans.