Every 39 seconds, somewhere on the internet, a website is hacked. Most of those hacks succeed not because of sophisticated attackers, but because website owners skipped basic protections. This 12-step checklist turns your site into a hard target - and most steps take minutes.

Table of Contents

1-3. Encryption and Access

  1. Enable SSL/HTTPS everywhere - encrypt all traffic with a free certificate. See our SSL guide.
  2. Use strong, unique passwords for hosting, cPanel, admin and email.
  3. Enable two-factor authentication on every account that offers it.

4-6. Software and Backups

  1. Update everything - CMS, plugins, themes, PHP - the moment updates exist.
  2. Remove unused software - old plugins and themes are open doors.
  3. Automate daily backups to offsite storage so any breach is recoverable.

7-9. Active Defense

  1. Install a security plugin/WAF (Wordfence, Sucuri) to block attacks.
  2. Limit login attempts to stop brute force.
  3. Restrict file permissions - most files read-only, writable only when needed.

10-12. Monitoring

  1. Watch for file changes - security plugins alert you to tampering.
  2. Check your site's status with uptime and malware monitoring.
  3. Review user accounts and access - remove old or unknown users regularly.

Frequently Asked Questions

How do I know if my website has been hacked?

Warning signs: browser warnings, unexpected redirects, new admin users, spam on your pages, or sudden speed drops. Security plugins and search results checks reveal most compromises.

Is paid website security worth it?

Free tools cover the basics well. Paid security adds a firewall and faster expert response - valuable for e-commerce and business sites that cannot afford downtime.

Security is a habit, not a purchase. Apply these twelve steps, schedule backups and updates, and your website becomes a fortress that attackers skip.