Basic website security every business site needs
· 2 min read · By the SYNTVEX team
You do not need to be a big company to be a target. Most attacks are automated and look for simple weaknesses on any site they can find. A few basics stop most of them.
Use HTTPS everywhere
HTTPS encrypts the data between your visitor and your website. Browsers warn people when a site does not use it, and it is needed for any form that collects personal details. Most hosts offer free certificates, so there is no good reason to skip it.
Keep everything updated
Outdated plugins, themes and libraries are the most common way sites get hacked. Apply updates regularly, and remove plugins you no longer use.
Passwords and access
- Use long, unique passwords for the admin panel, hosting and domain account
- Turn on two-factor authentication where it is offered
- Give each person their own account and remove access when someone leaves
Backups
Keep regular backups stored somewhere other than the web server itself. Then test that you can actually restore from one. A backup you have never restored is only a hope.
Protect your forms
Forms are often used for spam and attacks. Validate what people submit, use a spam filter or captcha, and never store more personal data than you need.
If your site is hacked
- Change all passwords: hosting, admin, database and email
- Restore from a clean backup if you have one
- Update everything before bringing the site back online
- Check Google Search Console for security warnings
- Ask your developer or hosting provider to find out how it happened