To secure your website, keep its software updated, lock down every login with strong passwords and two-factor authentication, serve it over HTTPS, put a web application firewall in front of it, and keep backups you can restore. Most website breaches exploit something simple: an outdated plugin, a reused password or a missing backup. Fix those first, then add monitoring and a plan for what to do if something goes wrong.<\/p>\n
Small business websites are rarely targeted by name. They are usually found by automated tools that scan the internet for known weaknesses. The common threats are:<\/p>\n
Your host controls the server your site runs on. Look for a provider that keeps server software patched, isolates accounts from each other, scans for malware and takes regular backups. Ask what happens if your site is hacked. Tremhost web hosting includes free SSL and daily backups. The managed cPanel VPS adds CloudLinux and Imunify360, which isolate accounts and scan for threats.<\/p>\n
An SSL\/TLS certificate encrypts data travelling between your site and its visitors, protecting logins, contact forms and payments. Browsers mark sites without HTTPS as “Not secure”. Free certificates are included with most hosting. Once installed, redirect all HTTP traffic to HTTPS. See how to install a free SSL certificate<\/a>.<\/p>\n Updates often fix security flaws that are already being exploited. Update your CMS core, plugins and themes promptly. Remove plugins and themes you do not use, because inactive code can still be attacked. Test large updates on a staging copy first, so an update does not break the live site.<\/p>\n A web application firewall (WAF) sits in front of your site and filters out malicious requests, such as SQL injection attempts, bad bots and known attack patterns, before they reach your server. A CDN-based service such as Cloudflare also absorbs DDoS traffic and caches your site. Tremhost’s Armor Guard<\/a> provides Cloudflare Pro, configured and monitored by Tremhost.<\/p>\n If you or a developer write custom code:<\/p>\n Backups are your last line of defence against ransomware, malware and mistakes. Keep several copies, store at least one away from the hosting account, and test a restore now and then. Read how to take a backup<\/a>.<\/p>\n Regular malware scans, file change alerts and uptime monitoring help you spot problems early. Check your site in search results too. A hacked site sometimes shows spam pages there before anything looks wrong on the homepage.<\/p>\n Many breaches start with a phishing email. Train staff to check links and sender addresses, and to never share login codes. Protect the computers used to manage the site with up-to-date endpoint security.<\/p>\n Know who to call, where your backups are and how to take the site offline if needed. If your site is hacked, change all passwords, remove the malicious code, close the gap that let the attacker in and ask search engines to review the site if it was flagged. Tremhost’s Armor SOS<\/a> offers free same-day triage for hacked sites.<\/p>\n No. SSL encrypts traffic between visitors and your site, but it does not stop an attacker from exploiting an outdated plugin or a weak password. It is one layer among several.<\/p>\n Yes. Most attacks are automated and scan for weaknesses, not for big names. A small site can be used to host spam, malware or phishing pages, or to attack others.<\/p>\n Daily is a sensible default for most business sites. Sites that change often, such as online shops, may need more frequent database backups.<\/p>\n Change your passwords from a clean device, then contact your host. Do not delete files at random. You may remove evidence of how the attacker got in.<\/p>\n3. Keep software updated<\/h2>\n
4. Lock down logins<\/h2>\n
\n
5. Use a web application firewall<\/h2>\n
6. Write and configure safely<\/h2>\n
\n
7. Keep backups you can restore<\/h2>\n
8. Monitor and scan<\/h2>\n
9. Secure the people, not just the site<\/h2>\n
10. Have a plan for when something goes wrong<\/h2>\n
Frequently asked questions<\/h2>\n
Does an SSL certificate make my website secure?<\/h3>\n
Is my small website really at risk?<\/h3>\n
How often should I back up my website?<\/h3>\n
What is the first thing to do if my site is hacked?<\/h3>\n
Next step<\/h2>\n