Understand the main risks
Outdated software
Old content-management systems, plugins, themes and libraries may contain known weaknesses.
Weak or reused passwords
A password used across email, hosting and website accounts can allow one compromise to affect multiple services.
Excessive access
Former staff, developers or agencies may retain administrator permissions long after they need them.
Unsafe forms and uploads
Poorly protected contact forms, file uploads and login pages can be abused.
Inadequate backups
Without a clean backup, recovery may require rebuilding content or accepting data loss.
Build a secure access process
Use unique strong passwords
Create different passwords for domain, hosting, website, database and email administration.
Enable multi-factor authentication
Use it where supported, particularly for email, hosting and administrative accounts.
Assign the lowest necessary permission
Not every user needs administrator access. Editors and content contributors should receive limited roles.
Remove old accounts
Review access whenever staff or service providers change.
Protect recovery channels
The email address used for password resets should itself be secured and controlled by the business.
Keep the website maintained
Update core software
Apply supported versions and security releases.
Review plugins and extensions
Remove components that are inactive, unsupported or unnecessary.
Use reputable sources
Do not install pirated themes, plugins or software packages.
Test important changes
Back up first and check forms, navigation and key functions after updates.
Monitor unexpected changes
New users, altered files, strange redirects or unexplained traffic can indicate a problem.
Use SSL correctly
Encrypt visitor connections
HTTPS helps protect information transmitted between browsers and the website.
Redirect all versions
Configure HTTP pages to use HTTPS consistently.
Avoid mixed content
Images, scripts and styles should also load securely.
Renew certificates
Automatic renewal should be monitored rather than assumed.
Do not overstate SSL
A padlock does not prove that the business itself is trustworthy or that the website contains no malware.
Backups and recovery
Use more than one copy
A backup stored only on the same compromised server may not be enough.
Define frequency
The right schedule depends on how often content, orders or user information changes.
Include files and databases
Both may be required for full recovery.
Test restoration
A backup is useful only when it can be restored successfully.
Set retention periods
Keep enough versions to recover from an issue that was not noticed immediately.
Protect forms and business data
Collect only necessary information
Reducing data collection reduces exposure and simplifies privacy management.
Use spam protection carefully
Forms may need rate limits, validation or challenge mechanisms without making them unusable.
Secure file uploads
Restrict file types, sizes and storage locations.
Limit sensitive information in email
Form notifications should not expose more personal data than necessary.
Publish privacy information
Explain what information is collected and how enquiries are handled.
Create an incident response plan
Know who to contact
Record hosting, developer, domain and email support contacts.
Preserve logs where possible
Logs can help identify what happened and when.
Reset credentials systematically
Change passwords for affected accounts and related recovery email accounts.
Close the cause before restoring
Restoring a backup without fixing the vulnerability can lead to immediate reinfection.
Communicate responsibly
Where customer or personal data may be affected, obtain appropriate legal and technical advice.
Frequently asked questions
Does an SSL certificate make a website fully secure?
No. SSL encrypts data between the visitor and website, but it does not replace updates, strong passwords, backups, secure hosting or malware protection.
How often should website software be updated?
Updates should be reviewed and applied regularly based on risk and compatibility. Critical security fixes should not be ignored, but changes should be backed up and tested where possible.
Is a small business website likely to be targeted?
Yes. Many attacks are automated and scan large numbers of websites rather than targeting only large companies.
What should a business do after a website is hacked?
Restrict access, preserve evidence where possible, contact the host or developer, identify the cause, restore from a clean source, reset credentials, update software and monitor for reinfection.