How to protect your website from hackers: 10 essentials

Most websites are not hacked by someone targeting them personally, but by automated tools scanning the internet for easy weaknesses. These ten basics close most of those doors.

Keep everything updated

1. Update software regularly. Your content management system, plugins, themes and server software all receive security fixes. Outdated software is the most common way in.

2. Remove what you do not use. Old plugins, test pages and unused accounts are extra doors left open.

Lock down your logins

3. Use strong, unique passwords and a password manager for every admin, hosting and email account.

4. Turn on two-factor authentication for everyone who can sign in to the admin area.

5. Give people only the access they need, and remove access as soon as someone leaves.

Protect the site itself

6. Use HTTPS everywhere, so data between visitors and your site is encrypted.

7. Add a web application firewall that blocks known attacks and suspicious traffic before it reaches your site.

8. Limit login attempts to stop password-guessing robots.

Be ready if something happens

9. Keep automatic, off-site backups and test that you can restore them.

10. Monitor your site for downtime, unexpected changes and security warnings, so you can act within minutes instead of weeks.