Most hacked websites are not targeted personally. They are found by automated tools looking for old software and weak passwords.
Keep everything updated
Out-of-date themes, plugins and software are the most common way in. Update on a schedule or choose a setup with fewer moving parts.
Use strong, unique passwords and two-step login
Use a password manager, turn on two-step verification for hosting, email and domain accounts, and never reuse a password.
Reduce what can be attacked
Every plugin and script is another door. Remove what you do not use. A simple static website has no database or admin login to attack at all.
Back up and test the backup
Keep regular backups away from the website itself and check that you can restore one. A backup you cannot restore is not a backup.
Add security headers and HTTPS
HTTPS and security headers tell browsers to refuse many common attacks. You can check yours for free on securityheaders.com.
If you are hacked
Change every password, restore a clean backup or rebuild, remove unknown users and scheduled tasks, scan your own computer and ask Google to review your site if it was flagged. Clean every site on the same hosting account, because infections can spread between them.
Common mistakes to avoid
Leaving old plugins and themes installed. Every unused plugin is another way in.
Reusing passwords. One leaked password can unlock hosting, email and your website together.
Cleaning only one site. If several sites share one hosting account, an infection can spread, so check them all.
A quick checklist
- Turn on two-step login for hosting, email and your domain
- Keep software updated and remove unused plugins
- Keep a tested backup away from the website
- Check security headers on securityheaders.com
- Know who to call if something looks wrong
Want help turning this into a plan for your business? Talk to Uniwebo or message us on WhatsApp.
