How to protect your website from cyber-attacks

Whether you’ve had your website for years, or just getting started, making sure your website is safe from hackers and other cyber-attacks should be a top priority.

Even if you think your website isn’t a target, you can never be too careful, especially if you have sensitive data.

Why Protect Your Website?

Hackers and viruses can damage your business reputation by infecting your site with ransomware, redirecting customers to a different site or even taking your site down completely.

Preventing loss of sensitive data including patents or customer data should be a top priority when maintaining your site. The trust a customer builds with your brand will easily be broken if hackers manage to steal their data. Users want to know that any data they input into your site is protected.

Implementing security protocols for your website also helps improve and maintain your SEO rating, ensuring that search engines value your business and therefore, improve your standing in search results.

Here are a few things you can do to keep your website safe:

Keep your software updated

This is the single most important security measure you can take. Over 90% of successful WordPress attacks exploit known vulnerabilities in outdated plugins, themes, or core software.

Why updates matter for security

When security researchers discover vulnerabilities in website software, developers release updates to patch those flaws. However, hackers also learn about these vulnerabilities, often within hours of the patch being released. They then scan the internet for websites still running the vulnerable versions.

If your website hasn’t been updated, you’re essentially leaving your front door unlocked with a sign saying “vulnerable system here.”

What needs updating

WordPress core (or your CMS platform)
The underlying system your website runs on receives regular security patches. Major updates may include significant security improvements.

Plugins and extensions
These are the #1 target for attackers because:

• They’re developed by third parties with varying security standards
• Popular plugins are used on thousands of sites (high-value targets)
• Many site owners delay or skip plugin updates
• Older, abandoned plugins contain unpatched vulnerabilities

Themes
Your website’s design code can also contain security flaws, especially if using commercial or custom themes.

Server software (PHP, MySQL, etc.)
The server environment itself needs regular updates, which your hosting provider should manage.

The update dilemma

Many business owners avoid updates because they’re concerned about:

• Breaking existing functionality
• Compatibility issues between components
• Downtime during updates
• Not understanding what’s changing

These are valid concerns, which is why professional maintenance is valuable. Updates should be:

• Tested in a staging environment first
• Applied with proper backup procedures in place
• Monitored for issues after implementation
• Managed by someone who understands the dependencies

The risk of not updating is far greater than the risk of updating properly.

Real example: In 2021, a vulnerability in a popular contact form plugin affected over 5 million websites. Sites that hadn’t updated were compromised within 48 hours, some losing customer data and being blacklisted by Google.

Learn more about professional website maintenance

Strong passwords and two-factor authentication

Weak passwords remain one of the easiest entry points for hackers. Brute force attacks, where hackers use automated tools to try thousands of password combinations are constantly targeting WordPress admin areas.

Password requirements

Your website passwords should:

• Be at least 14 characters long (preferably 16+)
• Include uppercase, lowercase, numbers, and symbols
• Not contain dictionary words or personal information
• Be unique (never reused across sites)
• Be stored in a password manager, not written down or saved in browsers

Critical: Never use “admin” as a username. This is the first thing attackers try.

Two-factor authentication (2FA)

2FA adds a second layer of security beyond your password. Even if someone steals your password, they can’t access your site without the second factor, typically a code from your phone.

For WordPress sites, plugins like Wordfence or iThemes Security can add 2FA. We recommend enabling this for all admin users.

Limit login attempts

Configure your site to lock out users after a set number of failed login attempts (typically 3-5). This prevents brute force attacks from continuing indefinitely.

Ensure your website has a valid SSL certificate

An SSL (Secure Sockets Layer) certificate encrypts data transmitted between your website and your visitors. This is essential for:

• Protecting login credentials
• Securing form submissions
• Processing payments
• Maintaining customer trust
• SEO rankings (Google favours HTTPS sites)

How to check

Look at your website address in the browser:

✅ https://yoursite.com (with padlock icon) = Protected

❌ http://yoursite.com (no padlock) = Not protected

Modern browsers actively warn visitors away from sites without SSL, displaying “Not Secure” warnings that damage trust and conversion rates.

Note: SSL certificates need annual renewal. If yours expires, visitors will see scary security warnings. Professional hosting or maintenance packages handle this automatically.

Maintain regular backups

Backups won’t prevent attacks, but they’re your insurance policy. If something goes wrong, whether from a hack, a bad update, or a server failure, backups let you restore your site quickly.

What to back up

• Database – All your content, posts, products, users
• Files – Themes, plugins, uploads, custom code
• Configuration – Settings and customisations

Backup frequency

• Daily for e-commerce or frequently updated sites
• Weekly for most business websites
• Before any updates as an extra precaution

Critical considerations

Storage location: Backups stored on the same server as your website aren’t safe. If the server is compromised or fails, you lose both the site and the backups. Store backups off-site (cloud storage, separate server, etc.).

Test your backups: Many businesses discover their backups don’t work when they need them. Periodically test restoration to verify your backups are viable.

Retention period: Keep multiple versions (at least 30 days). Sometimes issues aren’t discovered immediately, and you need to roll back further.

Professional hosting and maintenance packages typically include automated, off-site backups with retention policies and tested restoration procedures.

Implement security monitoring

Prevention is ideal, but detection is essential. Security monitoring helps you identify threats early, often before they cause damage.

What to monitor

File changes
Security plugins can alert you when core files are modified unexpectedly – often the first sign of a compromise.

Login attempts
Track failed login attempts to identify brute force attacks. Repeated attempts from the same IP addresses should trigger blocks.

Malware scanning
Regular automated scans check for known malware signatures, suspicious code patterns, and security vulnerabilities.

Uptime monitoring
If your site goes down unexpectedly, you need to know immediately. Downtime could indicate an attack or technical failure.

WordPress security plugins

Popular options include:

• Wordfence – Comprehensive security with firewall, scanning, and monitoring
• Sucuri – Strong malware scanning and clean-up services
• iThemes Security – User-friendly security hardening

Important: Security plugins are tools, not complete solutions. They work best as part of a comprehensive security approach that includes regular updates and professional oversight.

Firewall protection

A web application firewall (WAF) acts as a shield between your website and potential threats, filtering malicious traffic before it reaches your site.

How firewalls work

Firewalls monitor incoming traffic and block requests that match known attack patterns, such as:

• SQL injection attempts
• Cross-site scripting (XSS) attacks
• Brute force login attempts
• Suspicious bot traffic
• Requests from known malicious IP addresses

Types of firewall protection

Application-level firewalls
Security plugins like Wordfence include built-in firewalls that run on your website itself. These are effective but use your server resources.

Network-level firewalls
Services like Cloudflare or Sucuri provide firewall protection before traffic even reaches your server. These are more powerful and don’t impact your site’s performance.

Server firewalls
Your hosting provider should maintain server-level firewalls that restrict access to specific ports and services. Quality managed hosting includes this by default.

Making the most of firewall protection

Most website owners benefit from a combination approach:

• Server-level firewall (provided by hosting)
• Cloud-based WAF (like Cloudflare’s free tier or paid security services)
• Application firewall via security plugin (for WordPress-specific protection)

Your hosting provider can advise on which combinations work best for your specific setup and traffic levels.

Control file uploads carefully

If your website allows users to upload files, whether team members, customers, or members, this creates a potential security risk. Malicious files can contain viruses, malware, or code that compromises your site.

Protective measures

Restrict who can upload
Limit file upload capabilities to trusted users only. Review user permissions regularly and remove upload access from accounts that don’t need it.

Scan uploaded files
Implement anti-virus scanning on all uploads. Many security plugins can scan files automatically, rejecting suspicious uploads before they’re stored.

Restrict file types
Only allow file types you actually need. For example, if users only need to upload images, block executable files (.exe, .php, .js, etc.) entirely.

Store uploads securely
Ensure uploaded files are stored in directories without execute permissions, preventing uploaded scripts from running even if they bypass other checks.

For most business websites, file uploads are only needed in the admin area. If you don’t need public file uploads, disable this functionality completely.

Choose plugins and extensions carefully

Prevention is better than cure. The plugins you install today determine your security risk tomorrow. Making smart choices upfront reduces your ongoing security burden.

Evaluating plugins before installation

Active maintenance
Check when the plugin was last updated. If it hasn’t been updated in over 6 months, it’s potentially abandoned and shouldn’t be trusted.

Number of active installations
Popular plugins (100,000+ installations) receive more scrutiny from security researchers and are more likely to have vulnerabilities discovered and patched quickly. However, they’re also higher-value targets for attackers.

Developer reputation
Research the plugin developer. Do they maintain multiple well-regarded plugins? Do they respond to support requests? Do they have a track record of security?

Reviews and ratings
Read recent reviews. Look specifically for mentions of security issues, conflicts with other plugins, or poor developer support.

Required permissions
Some plugins request excessive permissions. Be wary of plugins that ask for more access than seems necessary for their stated function.

Plugin hygiene

Audit regularly
Every quarter, review your installed plugins. Remove any you’re not actively using – inactive plugins can still be exploited if they contain vulnerabilities.

Avoid nulled or pirated plugins
“Free” versions of premium plugins are often modified to contain malware, backdoors, or malicious code. They’re never worth the risk.

Don’t over-install
Every plugin increases your attack surface and potential compatibility issues. Before installing a plugin, ask: “Do I really need this, or can I achieve the same goal another way?”

When plugins cause problems

Even well-maintained plugins can conflict with each other or cause issues after updates. This is why testing updates in a staging environment is essential – it lets you identify problems before they affect your live site.

Professional maintenance includes plugin evaluation, regular audits, and the testing infrastructure to safely manage plugin updates.

Hosting and server security

Your website security is only as strong as the infrastructure it runs on. While you can’t always control server-level security directly, you can make informed hosting choices.

What hosting providers should offer

Regular server updates
Your hosting provider should maintain up-to-date server software, including:

• Operating system security patches
• PHP version updates (WordPress requires specific PHP versions for security)
• Database software updates
• Server security protocols (SSH, etc.)

Server isolation
On shared hosting, you share server resources with other websites. Quality hosts implement isolation measures so that if another site on the server is compromised, yours isn’t affected. Managed WordPress hosting typically provides better isolation than budget shared hosting.

Security monitoring
Professional hosting includes server-level monitoring for suspicious activity, DDoS attacks, and unusual resource usage patterns.

Backup systems
Beyond your website’s own backups, hosting-level backups provide an additional safety net. Verify what backup provisions your host includes.

Upgrading your hosting for security

If you’re on budget shared hosting, consider these upgrades:

• Managed WordPress hosting – Optimised for WordPress with automatic updates and security hardening
• VPS or cloud hosting – Greater isolation and control over the server environment
• Hosting with included security – Some hosts bundle WAF, malware scanning, and SSL management

Our hosting packages include these security features as standard, along with daily backups, SSL management, and performance optimisation.

DNS security

Your domain name system (DNS) records control where your website traffic goes. Ensure your domain registrar account has:

• Strong password and 2FA enabled
• Registrar lock enabled (prevents unauthorised transfers)
• DNS records managed by a reputable provider

Attackers who compromise your DNS can redirect your traffic to malicious sites while your actual website remains intact.

Additional security measures

Beyond the core security practices, these additional measures provide extra protection:

Country blocking

If your business only serves specific countries, you can block traffic from countries where you don’t operate. This is particularly effective against countries with disproportionately high attack volumes.

However, this is a blunt instrument – it can block legitimate users (travellers, VPN users) and doesn’t stop attacks from allowed countries. Use this as one layer among many, not a primary defence.

Hide your WordPress version

By default, WordPress broadcasts its version number in the site code. Security plugins can hide this information, making it slightly harder for attackers to identify vulnerable sites. This is “security through obscurity” and shouldn’t be relied upon, but it doesn’t hurt.

Disable file editing in WordPress admin

WordPress allows admins to edit theme and plugin files directly through the dashboard. While convenient, this is also a massive security risk if an attacker gains admin access. Disabling this feature (via wp-config.php) prevents attackers from injecting malicious code even if they compromise your login.

Security headers

HTTP security headers tell browsers how to handle your website’s content securely. Examples include:

• Content Security Policy (CSP) – Controls what resources can load
• X-Frame-Options – Prevents your site being embedded in malicious iframes
• Strict-Transport-Security – Forces HTTPS connections

These are typically configured at the server or hosting level. Quality managed hosting includes appropriate security headers by default.

Activity logging

Maintain logs of admin actions, login attempts, file changes, and other significant events. If something goes wrong, logs help identify what happened, when, and potentially who was responsible.

Many security plugins include activity logging. For high-security sites, consider dedicated logging services that store logs separately from your website.

---

The cost of inadequate security

While security measures require investment – whether your time, tools, or professional services – the cost of inadequate security is far higher.

A compromised website can result in:

• Direct financial loss from stolen payment information or ransomware demands
• Recovery costs often running into thousands of pounds for professional clean-up and restoration
• Lost revenue during downtime while the site is offline or blacklisted
• Customer trust damage that’s difficult to quantify but can be devastating long-term
• Legal liability particularly under GDPR if customer data is compromised
• SEO penalties as Google blacklists compromised sites, sometimes permanently
• Reputation damage that extends beyond your website to your entire business

Professional website maintenance typically costs a fraction of recovering from a single security incident.

---

Your website security workflow

Whether you manage security yourself or work with a developer, here’s what effective website security looks like:

1. Daily: Automated monitoring
   • Security plugin monitoring file changes
   • Uptime monitoring ensuring site availability
   • Automated daily backups running
2. Weekly: Quick security check
   • Review security alerts and login attempts
   • Check for urgent security updates
   • Verify backups completed successfully
3. Monthly: Maintenance and updates
   • Apply all pending security updates (tested first)
   • Review user accounts and remove unused ones
   • Check SSL certificate expiry date
   • Review security logs for suspicious patterns
4. Quarterly: Security audit
   • Full malware and vulnerability scan
   • Audit installed plugins – remove unused ones
   • Review user permissions and access levels
   • Test backup restoration procedure
   • Change important passwords
5. Annually: Comprehensive review
   • Full security assessment
   • Review hosting security arrangements
   • Assess whether plugin/theme replacements needed
   • Update security policies and procedures

The reality: Maintaining this level of security requires technical knowledge, monitoring tools, testing environments, and consistent attention. Most businesses find that professional maintenance provides better security at lower risk than trying to manage it in-house.

Explore our maintenance packages

Need help with website security?

Website security requires ongoing attention, technical expertise, and proper tools. If you’re concerned about your website’s security or want professional oversight, our maintenance packages include:

• Monthly security updates and patches
• 24/7 security monitoring and alerts
• Daily automated backups
• Malware scanning and removal
• SSL certificate management (where applicable)
• Priority support for security issues

We’re also Cyber Essentials certified, demonstrating our commitment to security best practices.

View our maintenance packages or get in touch to discuss your security concerns.