Hosting By Lui Nobrega · May 13, 2026 · Updated Oct 26, 2026 · 7 min read

Step 1: Keep your software up to date

When a security hole is fixed in an update, the details of the hole become public. From then on, every site that skipped the update is an easy target. Updates are boring, and that is exactly why they get skipped.

1. Make a list of everything your site runs on: the platform (for example WordPress), the theme, every plugin, and the PHP version on the server if your site uses PHP.
2. Back up the site before a big update, so you can roll back if something breaks. See: Upgrading WordPress (opens in a new tab)
3. Turn on automatic updates where your platform or host offers them. Then check every week or two for anything that did not update on its own.
4. Delete plugins and themes you do not use. Get new ones only from the official WordPress.org directory or well known companies. See: Hardening WordPress (opens in a new tab)
5. Ask your host which PHP version your site runs. Each PHP version gets two years of full support and two more years of security fixes only. After that it gets no fixes at all. See: PHP: Supported Versions (opens in a new tab)

Step 2: Back up, and test a restore

A backup is a full copy of your site saved somewhere else. A backup nobody has ever restored is a guess, not a plan.

1. Ask your host what it backs up, how often, how long it keeps copies, and how you request a restore. Write the answers down.
2. Keep your own copies too. WordPress suggests keeping 3 to 5 recent backups in different places, such as your host, a cloud drive and your own computer. See: Backups (WordPress Advanced Administration Handbook) (opens in a new tab)
3. Back up often enough. WordPress suggests once a week for a small site and every day for a busy one. For WordPress, back up both the files and the database. You need both to restore the site.
4. Restore a backup at least once, to a test copy of the site, not the live one. Then you know it works and how long it takes.
5. Write the restore steps down, so someone else can do it if you are away.

Step 3: Turn on two-step login everywhere that matters

Two-step login, also called multi-factor authentication, asks for something more than your password. If your password is stolen, the thief still cannot get in.

1. List the accounts that control your site: your hosting account, your domain registrar, your website admin login, and the email inbox that receives their password reset links.
2. Turn on two-step login on every one of them that offers it. NIST, the federal standards agency, recommends it on all accounts that offer it. See: Multi-Factor Authentication (NIST Small Business Cybersecurity Corner) (opens in a new tab)
3. If an account offers a passkey or a security key, use it. NIST notes that codes sent by text and other one-time codes can still be phished.
4. If your business email is a Google account, turn on 2-Step Verification there first, because it can reset everything else. See: Turn on 2-Step Verification (opens in a new tab)
5. Save the backup codes each service gives you somewhere safe, off the computer you use every day.

Step 4: Protect your domain name

Whoever controls your domain controls where your website and your email go. Losing it to an expired card or a stolen login is one of the worst things that can happen to a small business site.

1. Look up your domain to see which registrar holds it and when it expires. See: ICANN Lookup (opens in a new tab)
2. Make sure the domain is registered to your business, not to a former employee or web designer, and that the contact email is one you read. See: Information for Domain Name Registrants (opens in a new tab)
3. Turn on auto-renew and keep the card on file current.
4. Ask your registrar to keep a transfer lock on the domain. ICANN says this kind of status can help prevent unauthorized transfers. See: EPP Status Codes: What Do They Mean, and Why Should I Know? (opens in a new tab)
5. Turn on two-step login at the registrar, as in Step 3.

Step 5: Use strong, unique passwords

1. Use a password manager to create and store a long, random password for every account. NIST suggests it for small businesses. See: Cybersecurity Basics (NIST) (opens in a new tab)
2. Never reuse a password between your website, your host, your registrar and your email. One leak should not open every door.
3. Avoid short passwords and passwords that are only numbers or only letters. WordPress lists both as things to avoid.
4. Do not share one login among several people. Give each person their own, so you can remove one person without changing everyone's password.

Step 6: Give people only the access they need

Most of the real risk is not clever hacking. It is an old login that still works for someone who no longer needs it.

1. Give each person the lowest role that does the job. In WordPress, an Editor can publish and manage posts. Only an Administrator can change plugins, themes and users. See: Roles and Capabilities (WordPress Documentation) (opens in a new tab)
2. Keep administrator access to one or two people.
3. Remove access the day someone leaves or a project ends. That includes former staff, freelancers and agencies, at your host and registrar as well as on the site.
4. Look over the user list on each account a few times a year and remove anyone you do not recognize.

Step 7: Use HTTPS on every page

HTTPS encrypts the connection between your site and your visitors, so nobody in between can read or change what they send. Google's web.dev team says to protect every website with HTTPS, even sites that do not handle sensitive information.

1. Open your site. The address should start with https:// and show no warning. Type it with http:// and check that it switches to https:// on its own.
2. Ask your host whether it gets and renews your certificate for you. Many hosts do this automatically with free certificates from Let's Encrypt. See: Getting Started (Let's Encrypt) (opens in a new tab)
3. Make sure renewal is automatic. A standard Let's Encrypt certificate is valid for 90 days today, and Let's Encrypt plans to cut that to 64 days in February 2027 and 45 days in 2028. A manual process is easy to forget. See: Decreasing Certificate Lifetimes to 45 Days (opens in a new tab)
4. Run a free test of your certificate setup and fix anything it flags. See: SSL Server Test (Qualys SSL Labs) (opens in a new tab)

Step 8: Watch for trouble

You want to hear about a problem from a warning email, not from a customer.

1. Add your site to Google Search Console. It is free and emails you when Google finds issues on your site. See: Google Search Console (opens in a new tab)
2. Check its Security issues report now and then. It shows if Google finds hacked content or harmful software on your site. See: Security issues report (opens in a new tab)
3. If you think you were hacked, call your host first. Restore a clean backup, change every password from Step 3, and fix the hole that let them in. Then ask Google to review the site from the same report.
4. If you would rather not do all of this yourself, read what a managed hosting plan should cover. See: What Is Managed Hosting (and Do You Need It)?

Common questions

Sources and further reading

• Cybersecurity Basics (opens in a new tab) · NIST Small Business Cybersecurity Corner
• Multi-Factor Authentication (opens in a new tab) · NIST Small Business Cybersecurity Corner
• Hardening WordPress (opens in a new tab) · WordPress Advanced Administration Handbook
• Backups (opens in a new tab) · WordPress Advanced Administration Handbook
• Why HTTPS matters (opens in a new tab) · web.dev
• FAQ (opens in a new tab) · Let's Encrypt
• EPP Status Codes: What Do They Mean, and Why Should I Know? (opens in a new tab) · ICANN
• Security issues report (opens in a new tab) · Search Console Help

Update your software, keep tested backups, turn on two-step login, lock down your domain and remove old accounts. Those habits close the doors most attacks walk through.