Most hacked websites are not banks or big tech companies. They are small business sites, blogs, and online stores whose owners assumed nobody would bother with them. Hackers do not pick targets by hand. They run automated bots that scan millions of sites for known weaknesses. If your site has one, you are a target. This website security checklist gives you 15 practical ways to protect your site, ordered from the easiest wins to the deeper defenses.
You do not need to be technical to do most of these. Each item takes minutes to hours, not days. Work through the list in order, and by the end your site will be harder to hack than the vast majority of websites on the internet.
Why Your Small Site Is a Target Too
Here is the uncomfortable truth: hackers rarely care about your business specifically. They want your server’s computing power, your email reputation, and your visitors’ trust. A hacked small site becomes a spam-sending machine, a host for phishing pages that steal credit cards, or a stepping stone to attack bigger targets.
The numbers are sobering. Tens of thousands of websites are hacked every single day, and the overwhelming majority are small sites running outdated software. The cleanup is painful: Google blacklists hacked sites, visitors see scary warnings, and recovery can take days or weeks. Prevention is dramatically cheaper than the cure. Let us get into the checklist.
1–3. Keep Everything Updated
Outdated software is the number one way websites get hacked. When a security flaw is found in WordPress, a plugin, or a theme, the fix is released as an update. Hackers then scan the internet for every site that has not installed it yet. Running old software is like leaving your front door open with a sign on it.
1. Update your CMS core promptly. WordPress, Joomla, Drupal, whatever you run: install core updates within days of release, not months. Enable automatic minor updates, which handle security patches without breaking anything.
2. Update themes and plugins just as fast. Plugins cause the majority of WordPress hacks. Update them weekly at minimum. If a plugin has not been updated by its developer in over a year, replace it. Abandoned plugins are future vulnerabilities.
3. Delete what you do not use. Every installed theme and plugin is a potential entry point, even if deactivated. Delete unused themes and plugins entirely. Fewer doors means fewer ways in.
4–6. Passwords and Two-Factor Authentication
Weak and reused passwords are the second most common way sites fall. Bots try thousands of username and password combinations against login pages every hour. “Password123” and your dog’s name will not survive.
4. Use strong, unique passwords everywhere. Every account gets its own long password: at least 16 characters, random, never reused. Your hosting account, your CMS admin, your email, your FTP. If one service leaks, the damage stays contained.
5. Use a password manager. Nobody can remember fifty strong passwords, and you should not try. A password manager generates and stores them securely. This single habit eliminates the excuse for weak passwords forever.
6. Turn on two-factor authentication (2FA). Even if someone steals your password, 2FA stops them. Use an authenticator app rather than SMS codes when possible. Enable 2FA on your CMS admin, your hosting account, your domain registrar, and your email. This is the highest-value five minutes in website security.
7. Backups: Your Undo Button
Backups do not stop hacks, but they decide whether a hack is a bad afternoon or a business-ending disaster. With a good backup, you can wipe a hacked site and restore a clean copy in under an hour. Without one, you may lose everything.
7. Automate off-site backups. Your backup must run automatically, at least daily for active sites, and must be stored somewhere other than your web server. If the server is compromised, backups on the same server are compromised too. Test restoring from a backup at least once. A backup you have never tested is a hope, not a plan. Many IT support plans include managed backups if you would rather not think about it.
8–10. SSL, Firewalls, and Malware Scans
These three form your site’s outer defenses: encrypting traffic, blocking attackers before they reach you, and catching anything that slips through.
8. Use HTTPS everywhere with a valid SSL certificate. SSL encrypts data between your visitors and your site. Without it, passwords and payment details travel in plain text. It is also a Google ranking factor, and browsers now warn visitors away from non-HTTPS sites. Free certificates from Let’s Encrypt are fine for most sites. Make sure every page loads over HTTPS, not just the checkout.
9. Install a web application firewall (WAF). A WAF sits in front of your site and blocks malicious traffic: SQL injection attempts, known exploit patterns, bot attacks. Cloud-based options like Cloudflare’s free tier add meaningful protection in about fifteen minutes. Plugin-based firewalls like Wordfence work too. Think of it as a bouncer who knows all the troublemakers by face.
10. Run regular malware scans. Scan your site weekly with a reputable security plugin or service. Scans catch injected spam links, malicious redirects, and backdoor files early, often before Google or your visitors notice. Pair scanning with file-change alerts so you know the moment something unexpected appears.
11–14. Lock Down Logins and User Accounts
Your login page is the most attacked page on your site. These four steps make it a much harder target.
11. Limit login attempts. Bots guess passwords thousands of times per hour. A login limiter blocks an IP address after a handful of failed attempts. Most security plugins include this. It is a one-click setting that defeats the most common attack on the internet.
12. Change the default admin username. If your admin username is “admin,” attackers already know half your login. Create a new administrator account with a unique username, then delete the old “admin” account. Never use predictable usernames anywhere.
13. Give users the minimum access they need. Not everyone needs an administrator account. Editors edit, authors write, shop managers manage orders. Every extra admin account is an extra key to your kingdom. Review your user list quarterly and remove accounts for people who no longer need access, especially former contractors.
14. Disable file editing from the dashboard and set proper permissions. WordPress lets admins edit theme and plugin files from the dashboard by default. If an attacker gets an admin account, this hands them code execution. Disable it. Also make sure file permissions on your server are set correctly (typically 644 for files, 755 for folders) so the web server cannot rewrite its own code.
15. Have a Plan for When Something Gets Through
No checklist makes you invincible. The final item is knowing exactly what to do if the worst happens, before panic sets in.
15. Write down your incident response plan. It can be one page: who to call (your host, your developer), where your clean backups are, how to put the site in maintenance mode, and how to request a Google review once clean. Keep your host’s support number somewhere you can find it at midnight. Sites with a plan recover in hours. Sites without one flail for days.
Work through this list once, then put the recurring items on a schedule: updates weekly, scans weekly, backup tests monthly, user reviews quarterly. Security is a habit, not a project. If you would rather hand the whole thing to professionals, our IT support and website teams handle updates, backups, firewalls, and monitoring for clients every day. Get a fixed quote within 24 hours, with no lock-in.
Frequently asked questions
What is the website security checklist every site owner should follow?
The essentials: keep all software updated, use strong unique passwords with 2FA, run automated off-site backups, use HTTPS, install a firewall, scan for malware, limit login attempts, and give users minimum permissions. These cover the vast majority of real-world attacks.
How often should I update my website?
Check for updates weekly and install security updates within days of release. Enable automatic updates for minor security patches. Outdated plugins are the single most common way WordPress sites get hacked.
How do I know if my website has been hacked?
Warning signs include Google blacklist warnings, strange redirects, spammy links or content you did not add, sudden traffic drops, and emails bouncing from your domain. Weekly malware scans catch most infections early.
Is free SSL enough for my website?
Yes for most sites. Free certificates from Let’s Encrypt provide the same encryption as paid ones. Paid certificates mainly add warranty and validation features that matter for large enterprises, not small businesses.
How much does website security cost?
The basics are free: updates, strong passwords, 2FA, and free SSL cost nothing. A good security plugin runs $50 to $150 per year. Managed security with monitoring and backups typically starts around $50 to $200 per month.
Can a small website really get hacked?
Absolutely. Most hacks are automated bots scanning millions of sites for known weaknesses, not humans choosing targets. Small sites with outdated software are the most common victims precisely because owners assume they are safe.
Like what you just read?
Tell us about your project and get a clear, fixed quote within 24 hours — free, no obligation.
Get a free quote →