How to Keep a Website Secure, and What to Do If It Gets Hacked

1. Keep everything updated

The WordPress core, themes and plugins get updates as holes are closed; most known WordPress vulnerabilities turn up in plugins. Delete the plugins and themes you do not use; fewer plugins means fewer holes.

2. Strong passwords and two-factor login

Use long, different passwords for the admin panel, hosting, domain and email accounts, and turn on two-factor login. Give everyone who needs access their own user; do not share the main password.

3. Regular backups

Back up files and the database regularly, somewhere separate from the site's server. Try restoring from a backup at least once; a backup you cannot restore is not a backup.

4. SSL and security headers

The site should open only over https; the HSTS header reminds browsers of that. Headers such as a Content Security Policy (CSP) and X-Frame-Options make it harder to embed the site inside another page or run outside scripts on it. All of these headers are on for our own site.

5. Protect your forms

Contact forms and login pages are tried the most. Limiting many requests from the same address in a short time, a hidden field that traps bots (a honeypot) and blocking submissions from other sites stop most automated attacks. Our own contact form is protected by all three.

6. Regular scans and penetration testing

Scanning the site for known holes and having someone read the code is how you find a hole before an attacker does. A penetration test looks at the system through an attacker's eyes and is done only with the owner's permission.

What to do if your site is hacked

First put the site into maintenance mode to protect visitors from harmful content. Change every password: admin panel, hosting, database, FTP and email.

Restore from a backup you know is clean, or find and clean the changed files. Coming back without closing the hole the attacker used (an outdated plugin, a leaked password) leaves you open to the same attack again.

Google can flag compromised sites in search results. After the clean-up, request a review from the Security Issues report in Google Search Console.

If you want help

We do security audits, penetration tests and clean-ups of compromised sites; our cyber security services start from $100.