Website security is an ongoing business process. No plugin can replace secure access, timely maintenance, reliable backups, and a tested recovery plan.
Keep software and extensions current
Apply supported updates to the website platform, theme, plugins, and server environment. Remove unused extensions and replace software that is no longer maintained.
Protect administrator accounts
Use unique passwords, multi-factor authentication where available, and the lowest access level each person needs. Remove old accounts promptly and avoid sharing a single administrator login.
Maintain independent backups
Back up the database and website files on a schedule appropriate to how often the site changes. Keep more than one restore point and verify that a restore can actually be completed.
Use HTTPS everywhere
A valid TLS certificate protects information in transit and helps visitors confirm they are connected to the correct domain. Redirect every HTTP version to HTTPS and monitor certificate renewal.
Secure forms and customer data
Collect only the information the business needs. Protect forms from automated abuse, restrict access to submissions, and define how long data is retained.
Choose responsible hosting
Hosting should provide maintained server software, access controls, backups or snapshots, and a clear response process. Understand which security tasks belong to the host and which belong to the site owner.
Monitor and prepare for incidents
Watch for unexpected file changes, new users, traffic spikes, delivery failures, and search warnings. Keep current contact details and a recovery procedure so the team knows how to respond.
Include security in every change
New integrations, forms, accounts, and plugins can create new risk. Review access and data handling whenever the website changes rather than treating security as a one-time launch task.
If your site is difficult to maintain or uses unsupported components, review the signs that a website needs a redesign.
