Most website break-ins use simple weaknesses: reused passwords, outdated software and nobody responsible for either. A short routine closes most of the doors.
Protect the accounts
Use a unique password for your hosting, domain registrar, email and website admin, kept in a password manager. Turn on two-step sign-in wherever it is offered. Remove access for people who have left or finished a project.
Keep software up to date
Websites built on platforms and plugins need regular updates, because attackers target known flaws in old versions. Schedule a monthly check, test updates on a copy where you can, and remove plugins you no longer use.
Back up, and test the restore
Keep automatic backups of both files and database, stored away from the main server. A backup you have never restored is a hope, not a plan; try restoring to a test site at least once.
Use HTTPS and sensible forms
Serve the whole site over HTTPS, and keep any forms that collect personal data limited to what you need. Tell visitors what you do with the data in a privacy notice you actually follow.
Know who is responsible
- One named person owns the domain and hosting accounts, with recovery details stored safely.
- One named person or partner handles updates and backups.
- Everyone knows who to contact if the site behaves strangely.
If something goes wrong
Take the site offline if needed, change passwords, restore a clean backup and find out how access was gained before putting it back. Keep a short written note of what happened so you can prevent a repeat.
Security Website maintenance Backups
About the author
Written by Incipit Team. More articles by this author.
