Most hacks are automated and opportunistic, and most are preventable. Here's a practical security checklist for a small business website.
You don't need to be a security expert to protect your website from hackers. A handful of basics blocks the overwhelming majority of automated attacks. Here's the checklist.
Keep everything updated
Out-of-date software is the number one way sites get compromised. Update your CMS, plugins, themes and server software promptly. If you'd rather not manage this, a managed plan keeps it patched for you.
Use strong passwords and 2FA
Unique, long passwords and two-factor authentication on your admin, hosting and email accounts stop the most common break-ins outright. A password manager makes this painless.
Enable SSL and a firewall
Serve everything over HTTPS with a free SSL certificate, and put a firewall in front of your site to filter malicious traffic before it reaches you.
Back up, and limit access
Keep automatic off-site backups so you can recover fast, and give people only the access they need. On WordPress specifically, follow our guide to securing a WordPress site.
Key takeaways
- Update software promptly: it's the top fix.
- Use strong unique passwords and 2FA everywhere.
- Serve HTTPS and put a firewall in front of the site.
- Automate backups and limit who has access.
Hosting with security built in
Gander Web includes firewalls, free SSL, malware scanning and daily backups, plus managed patching if you want it.
See managed hostingFrequently asked questions
How do most small business websites get hacked?
Usually through outdated software or weak passwords, exploited by automated bots, not targeted attacks. Basics stop most of it.
Does SSL stop hackers?
SSL encrypts traffic and is essential, but it's one layer. Combine it with updates, strong passwords, backups and a firewall.
What should I do if my site is hacked?
Restore from a clean backup, change all passwords, update everything, and find how they got in so it can't recur.