Security: the basics every site needs
Most hacked sites are not the target of an attack. They are outdated installations that were found automatically. Security is therefore mostly hygiene, not a mysterious specialism.
01
The hygiene that prevents the most
Keep everything you use up to date: the system itself, extensions, libraries. This is by far the most important measure, and the reason 'we do not do maintenance' in practice means 'we are waiting for it to go wrong'.
Make sure traffic is encrypted with a valid certificate, and that it renews automatically. An expired certificate makes your site unusable for visitors and feels untrustworthy.
Limit who can reach what. Administrator rights only for those who need them, strong passwords and two-step verification on everything that grants access: the site admin, the domain, the hosting and the mail.
02
Backups you have restored
A backup never restored is a pile of hope. Test at least once whether you can actually restore a copy, and know how long that takes and who can do it.
Do not keep copies only on the same server: if it breaks or gets infected, the backups go with it. Keeping several points in time helps too, because infection is often discovered days later.
And think of data outside the site: the file archive, the inbox with enquiries and the exports from your admin.
03
What goes wrong with forms and logins
Forms are the most used entry point. Protect them against abuse, filter what comes in and never rely on checks that happen only in the browser — those are easy to bypass.
Logins need a limit on failed attempts, sessions that expire and passwords stored encrypted with a modern algorithm. Anyone emailing passwords or storing them readably has a bigger problem than they think.
Finally, make sure you get warned: an alert when the site is unreachable, when there are unusually many failed logins, or when something breaks. Knowing something is wrong is half the work.
- Updating is the most important measure, and not optional
- A valid certificate that renews automatically
- Two-step verification on site, domain, hosting and mail
- Backups elsewhere, and restored at least once
- Protect forms and logins, and set up alerts
Quick questions on this topic
Is my site interesting enough to be hacked?
Most break-ins are not targeted. Automated scripts scan the whole internet for known holes in outdated software and use what they find for spam, phishing or computing power. Being small is not protection.
What do I do if it goes wrong anyway?
Take the site offline or put it in maintenance, restore a clean copy from before the infection, change all passwords and then update everything. Find out how it got in before going live again, otherwise the same thing happens twice.
Knowledge base
A question that is not here?
Just ask. Plaincodelab answers even when the answer is that you do not need something.