Website Security and Hosting Checklist

Simple steps that prevent most website problems, and the signs something is wrong. Most small business sites get hacked through old software, weak passwords or missing backups, not targeted attacks. These checks cover the basics.

Backups

Back up files and databases every day.
Store backups off the server your site runs on.
Keep more than one backup, so you can go back before a problem started.
Test a restore at least once a year.

Updates

Update WordPress core, themes and plugins every month at minimum.
Delete plugins and themes you do not use.
Replace plugins that have not been updated by their developer in a long time.
Take a backup before updating, and check the site afterward.

Logins

Use a unique, long password for every admin, hosting and email account.
Turn on two-factor authentication.
Give each person their own login. Remove accounts for people who have left.
Give users only the access they need.

Hosting and Server Protection

SSL on every page (your address starts with https).
A web application firewall.
Malware scanning with automatic cleanup.
Brute force protection on logins.
Uptime monitoring so someone knows when the site goes down.

Warning Signs

Google shows a “this site may be hacked” warning.
Visitors get sent to other websites.
New admin users or pages you did not create.
A sudden drop in traffic or a spike in spam form fills.
Your hosting company or email provider flags your account.

If Something Looks Wrong

Change your passwords, contact your host and restore from a clean backup. Then find out how the attacker got in so it does not happen again.

Frequently Asked Questions

Is a security plugin enough?

It helps, but server-level protection, backups and regular updates matter just as much.

Do small sites really get attacked?

Yes. Most attacks are automated and scan every site they can find.

How often should I back up my website?

Back up files and databases every day, and store the backups off the server your site runs on. Keep more than one backup so you can go back before a problem started, and test a restore at least once a year.

How can I tell if my website has been hacked?

Warning signs include a Google “this site may be hacked” warning, visitors being sent to other websites and new admin users or pages you did not create. A sudden drop in traffic, a spike in spam form fills or a flag from your host can also signal trouble.

What should I do if my website gets hacked?

Change your passwords, contact your host and restore your site from a clean backup. Then find out how the attacker got in so it does not happen again.