Simple protection that stops most attacks — from HTTPS and backups to login limits and a properly configured firewall.
Small business websites get attacked constantly, not because anyone targets them personally, but because bots scan everything. These ten basics stop the overwhelming majority of that noise.
- HTTPS on every page, with HTTP redirected to HTTPS.
- Automatic daily backups stored somewhere other than your server.
- Strong, unique admin passwords and two-factor authentication.
- Limit login attempts and change the default login URL.
- Keep the platform, theme and plugins updated — most hacks exploit known, already-patched holes.
- Delete plugins and themes you are not using, instead of leaving them deactivated.
- A firewall and bot protection in front of the site, such as Cloudflare.
- CAPTCHA and server-side validation on every form.
- Correct file permissions and no editing of files from the dashboard.
- Security headers: HSTS, X-Content-Type-Options, Referrer-Policy and a Content Security Policy.
The one that saves you
Backups. Everything else reduces the chance of a problem. Backups are what let you recover in twenty minutes when something still goes wrong. Test your backup by actually restoring it once — an untested backup is a guess, not a safety net.
Security is not a plugin you install once. It is a handful of habits that take ten minutes a month.