Most website break-ins are not clever. They use an old plugin, a weak password or an account nobody remembered to remove. This checklist covers the basics.
Passwords and accounts
- Use a unique, long password for every admin account.
- Turn on two-step login where it is available.
- Give each person their own account; never share one.
- Remove accounts for people who have left.
Updates
Keep the content system, plugins and themes up to date, and delete any you no longer use. An inactive plugin can still be attacked.
Backups
Keep automatic backups stored away from the website, and test that one can be restored. A backup that lives on the same server disappears with it.
SSL and forms
Your site should load over HTTPS on every page, with no browser warnings. Contact forms should have spam protection, and you should test once a month that enquiries still reach your inbox.
Have a question about this? Send us a message and we will give you a straight answer. You can also read more about our website maintenance service.