Most website break-ins are not targeted attacks by skilled hackers. They are automated bots scanning millions of sites for a known weakness — an outdated plugin, a reused password, a forgotten test page — and exploiting whatever they find. That is good news: a short list of basic measures blocks the vast majority of attacks. Here is the checklist we use for small business websites and servers in 2026.
1. Keep everything updated
Outdated software is the number one way small websites get compromised. Bots look for known vulnerabilities in old versions of WordPress plugins, themes, frameworks, and server software.
- Update the CMS, plugins, and themes promptly — security updates within days, not months.
- Delete plugins and themes you no longer use; inactive code can still be exploited.
- Keep the server's operating system and software patched, or use managed hosting that does it for you.
2. Protect every login
- Use long, unique passwords stored in a password manager. Never reuse a password across services.
- Turn on multi-factor authentication for the website admin, hosting control panel, domain registrar, and email. Your domain and email accounts can be used to take over everything else.
- Give each person their own account with only the permissions they need, and remove access when someone leaves.
- Limit login attempts to slow down password-guessing bots.
3. Back up — and test the restore
A backup you have never restored is only a hope. Follow the 3-2-1 rule: three copies of your data, on two different types of storage, with one copy off-site, away from the server it protects. Back up both the files and the database, automatically and daily, and keep several days of history so you can go back to a point before an infection. Test a full restore at least twice a year.
4. Use HTTPS properly
Free certificates mean every site can and should use HTTPS. Go one step further:
- redirect all HTTP traffic to HTTPS;
- enable HSTS so browsers always use the secure connection;
- make sure certificates renew automatically — an expired certificate shows visitors a full-page warning and destroys trust instantly.
5. Add security headers
A few HTTP headers make common attacks much harder: a Content Security Policy controls which scripts may run, X-Frame-Options or `frame-ancestors` stops other sites from embedding yours to trick visitors, and X-Content-Type-Options and a sensible Referrer-Policy close smaller gaps. Free online scanners will show you which ones your site is missing.
6. Do not leave files lying around
Attackers routinely request files that should never be public: `.env` files with passwords, `.git` folders with your source code, database dumps, backup archives, and `phpinfo()` test pages. Make sure none of these can be downloaded from your web server, and that directory listing is switched off.
7. Secure your email domain
Even if your website is secure, criminals can send emails that appear to come from your domain. Publish SPF, DKIM, and DMARC records in your DNS. Start DMARC with a monitoring policy (`p=none`) and move to `p=quarantine` once you have confirmed that all your legitimate email passes. It protects your customers from phishing in your name, and it helps your own emails land in inboxes instead of spam.
8. Protect your forms from spam and abuse
Contact forms are a target for spam bots and, if poorly built, for injection attacks. Validate all input on the server, add rate limiting, use a hidden honeypot field or a privacy-friendly CAPTCHA, and never show raw error messages to visitors.
9. Limit what the server exposes
- Only open the ports you need (usually 80 and 443) and protect administrative access with keys instead of passwords.
- Never expose databases or admin tools such as phpMyAdmin directly to the internet.
- Make your web server refuse requests for unknown host names instead of showing a default site.
- Run each site with its own database user and file permissions, so one compromised site cannot take over the others.
10. Monitor, and have a plan
Set up uptime monitoring and alerts, review login and error logs regularly, and run a malware scan if anything looks unusual. Write down a simple incident plan: who to call, how to take the site offline, where the clean backups are, and which passwords to change first.
When to get help
If your site has been hacked once, assume the attacker may have left a back door: a clean rebuild from trusted sources is usually safer than trying to remove the infection file by file. We have rebuilt compromised sites from scratch for clients — new server, fresh software, scanned uploads, new passwords everywhere.
Our Linux administration services cover server setup, hardening, monitoring, and ongoing maintenance. If you are worried about your site's security, ask us for a review.
