Website security: 8 measures that need no technical background
Small sites are assumed to be safe; in reality automated scans try everyone. Eight basic measures you can apply yourself.
"My site is small, who would bother?" Most attacks aren't personal. Automated tools crawl the internet trying known vulnerabilities; they don't check how big you are.
1. Keep everything updated
This is the most common route in: a known vulnerability that already has a patch. If you use WordPress, core, theme and plugins should all be current.
Take a backup first, then update.
2. Delete plugins you don't use
Deactivating isn't enough — as long as the files sit on the server they still carry the vulnerability. If you don't use it, remove it completely.
3. Don't use "admin" as the username
Brute-force attempts start with "admin". A different username defeats a large share of them before they begin.
4. Turn on two-factor authentication
Even if your password leaks, nobody gets in without the second step. It should be on for everyone with access to the admin area.
5. Limit login attempts
Repeated failures from the same IP should be blocked. Most security plugins do this with one setting.
6. Take backups and test restoring them
The second half gets skipped most often. Plenty of businesses believe they have backups and only discover they're corrupt in the middle of a disaster.
Once a month, restore your backup to a test environment. It takes five minutes and saves a day.
7. Tighten file permissions
Folders on the server shouldn't be writable by everyone. The typical setting is 755 for folders and 644 for files. You can check this from your hosting panel.
8. Protect your forms
The contact form is the first stop for spam bots. You can defend it without a CAPTCHA: hidden fields (a honeypot), a check on how long the form took to fill, and a per-IP submission limit do the job without bothering any real visitor.
How to tell you've been compromised
- Pages you never created appear in search results
- Visitors say they're being redirected
- The browser warns "this site may be harmful"
- There are users in the admin area you don't recognise
If you notice any of these, put the site into maintenance mode first, then restore from a clean backup. Before attempting a cleanup, keep a copy of the current state — you may need it to understand what leaked.
- #security
- #maintenance
- #wordpress
