Website security basics: the habits that stop most attacks.
Most hacked websites are not targeted personally. They are caught by automated tools that look for outdated software, weak passwords and neglected plugins. This guide explains the common causes and the routine habits that prevent most problems, and when to bring in a professional.
- Most attacks are automated, and they look for outdated software and weak passwords.
- Updates, strong sign-ins, backups and fewer plugins prevent most problems.
- Have a plan for the day it goes wrong, and call a professional for anything serious.
6 min readPublished By Domeq Solutions
Why do small business sites get attacked?
It is rarely personal. Attackers use automated tools that scan huge numbers of websites for known weaknesses, such as an outdated plugin or a password that is easy to guess. A small business site is as easy a target as any other, and often easier, because nobody is watching it closely.
The aims vary: sending spam, hosting a fake page, stealing customer data or quietly adding links to another site. The result for you is the same: lost trust, a damaged search reputation and a clean-up bill.
This guide is general advice, not a security audit or a guarantee. A site that follows these habits is harder to attack, not impossible.
Most hacked sites were not chosen. They were found.
Which habits prevent most problems?
A short list of routine habits covers most of the risk. None of them is difficult, and they are the same habits that appear in a maintenance routine.
Ten habits that prevent most problems.
- Keep the platform, theme and plugins updated, after taking a backup
- Use long, unique passwords, kept in a password manager
- Turn on two-step sign-in for every admin and for hosting and domain accounts
- Give each person their own login, with only the access they need
- Delete plugins, themes and users you no longer use
- Install add-ons only from sources you trust, and check they are still maintained
- Use HTTPS everywhere, with the certificate set to renew
- Back up on a schedule, store a copy elsewhere and test a restore
- Keep a short list of who can change what, and review it every few months
- Watch for warning signs, such as unknown users, new pages or a sudden drop in speed
The website maintenance checklist puts these into a monthly, quarterly and yearly rhythm.
Why do passwords and sign-ins matter so much?
Stolen or guessed passwords are among the most common ways in. If one is reused across several services and one of them is breached elsewhere, an attacker can try it on your site.
A password manager makes unique passwords easy, and two-step sign-in means a stolen password alone is not enough. Turn it on for the accounts that matter most: the site's admin, the hosting account and the domain registrar, where an attacker could redirect the whole site.
Three security myths.
Nobody would bother attacking a small site.
Attacks are automated, so the size of the business does not matter. What matters is whether the software is out of date.
I have a security plugin, so I am safe.
A plugin helps, but it cannot replace updates, strong passwords and backups. It is one layer, not the whole defence.
HTTPS means the site is secure.
HTTPS protects data on its way between the visitor and the site. It does not stop an attacker using a weak password or an outdated plugin.
What makes a backup useful?
A backup is the safety net for every kind of failure: an attack, a bad update or a human mistake. It only helps if it is recent, kept somewhere other than the site itself and proven to restore.
Back up as often as the site changes. A site with daily orders needs daily backups, and a brochure site can manage weekly. Then, once or twice a year, actually restore one to a test site, because an untested backup is a hope, not a plan.
What should you do if the site is hacked?
Act calmly and in order. The aim is to stop the damage, find the way in, restore a clean copy and close the gap, so that the same thing does not happen again.
Six steps if you think the site has been hacked.
Stay calm and do not delete anything yet
Evidence of how the attacker got in may be needed.
Change passwords
Change the admin, hosting and domain passwords from a device you trust, and turn on two-step sign-in.
Contact your host and your developer
They can see server logs, isolate the site and often help with the clean-up.
Restore a clean backup
Use a copy from before the problem began, then update everything before the site goes back online.
Find and close the way in
Usually an old plugin, a weak password or an unused account. Fix the cause, not only the symptom.
Tell the people affected, if needed
If customer data was exposed, get advice on what you must report and to whom.
When should you call a professional?
Call a professional when the site holds customer data or takes payments, when you suspect a breach, or when you do not have the time to keep up with updates. A developer or maintenance service can apply the routine on a schedule.
Domeq's Website Maintenance & Optimization covers updates, backups and care on a schedule, for platforms including WordPress, Shopify and Next.js. Maintenance is free for the first month after a website project, and paid after that. Domeq does not give security guarantees or sign-offs, and security reviews of sensitive systems need a qualified specialist. See also WordPress Development, and check where your site stands with the free website audit.
Questions, answered.
Why do hackers target small business websites?
Mostly they do not choose targets. Automated tools scan huge numbers of sites for known weaknesses, such as outdated software, and small sites are often less closely watched.
What is the most common way websites get hacked?
Outdated software and plugins, and weak or reused passwords, are among the most common causes. Keeping everything updated and using strong, unique passwords prevents many attacks.
How often should I update my website?
Check for updates at least monthly, and apply security updates promptly, after taking a backup. A maintenance routine or service can do this for you on a schedule.
Is HTTPS enough to keep my website secure?
No. HTTPS protects data travelling between the visitor and the site, which is important, but it does not protect against weak passwords, outdated plugins or other ways in.
What is two-step sign-in?
A second check after your password, such as a code from an app, so that a stolen password alone does not get an attacker in. Turn it on for admin, hosting and domain accounts.
How do I know if my website has been hacked?
Warning signs include unknown users or pages, strange redirects, a warning from your browser or host, a sudden drop in speed or traffic, and spam sent from your domain. If you suspect it, change passwords and contact your host.
Does Domeq guarantee that my website will be secure?
No one can honestly guarantee that. Domeq builds and maintains websites with good practice, such as updates and backups, and offers maintenance after the free first month. Security reviews of sensitive systems need a qualified specialist.
Keep reading.
More guides on the same topic, and on the ones around it.
- Website Maintenance Checklist: Monthly, Quarterly, YearlyA website maintenance checklist with the monthly, quarterly and yearly tasks that keep a business site fast, secure and working.Website Maintenance & Optimization
- How to Improve Website Speed: Find What Is Slow, Then Fix ItHow to improve website speed: measure first, then fix images, scripts, fonts, hosting and caching in the order that gives the biggest gains on mobile.Website Maintenance & Optimization
- WordPress vs Next.js: Which Should Your Website Use?WordPress vs Next.js compared for business websites: editing, speed, cost of ownership, SEO and who each one suits, in plain English.Website Design & Development
Keep going.
The services behind this guide, if you would rather have it done.
Know what you need? Let's scope it.
Tell us about the business and the work. You get a reply within 24 hours.
