There's a line we hear a lot from small business owners: “Who would bother with my site?” It sounds reasonable, but that's not how most attacks work. Nobody sits down and picks your site. Automated bots scan huge numbers of sites looking for known vulnerabilities, weak passwords and outdated plugins. Being small doesn't protect you; it may just delay the moment someone notices.
We've ordered the 12 measures below from easy to hard. The first half needs no technical knowledge and can be done this week. The last part is server-side, where you may need help from your host or the team managing your site. Most examples use WordPress because it's a widely used platform, but the logic applies to any system.
No checklist makes a site completely secure. The aim is to reduce risk and recover quickly when something goes wrong.
Strong passwords and two-factor authentication
1. A separate, long password for every account. Admin panel, hosting, domain, email, database: each needs a different password, so a leak in one place doesn't open the others. The most realistic way to keep track is a password manager. We still often come across passwords like company name plus founding year.
2. Two-factor authentication. Even if a password is stolen, getting in without the second step (an authenticator app on your phone) becomes much harder. Turn it on first for the most critical accounts: the domain panel, hosting and company email. Someone who takes over your domain account can take your site and your email together.
Updates
3. Core, theme and plugin updates. A significant share of known vulnerabilities are exploited in software whose fix has already been released. Skipping updates is like knowing the lock has been replaced and still living with the old one.
Don't update blindly, though. Take a backup first, test on a staging environment if you can, then update the live site. Plugin conflicts are common with major version updates; we discussed this separately in our maintenance checklist.
4. Server software versions. If your site runs on an old PHP or database version, that version may no longer receive security patches. Check the version in your hosting panel and move to a supported one.
Plugin and theme hygiene
5. Delete unused plugins and themes. Deactivating isn't enough; as long as the files sit on the server, any vulnerability in them can still be used. On sites with dozens of plugins, we often find that some aren't used at all.
6. Stay away from “nulled”, that is cracked, themes and plugins. A free copy of a paid plugin often comes with hidden malicious code, and it's a licence violation too. The few hundred lira you save is small next to the cost of cleaning the site.
When choosing a plugin, check the last update date, the number of installs and how responsive the developer is in the support forum. A plugin that hasn't been updated for a long time may be abandoned.
Limiting admin access
7. Give everyone only the access they need. A staff member who posts blog articles needs editor or author rights, not administrator. When you stop working with an agency, close their account. The same goes for staff who leave. This simple discipline prevents a lot of trouble.
8. Protect the login page. Don't use “admin” as a username, and limit failed login attempts (for example, a 15-minute lockout after 5 tries). If possible, change the admin URL or allow access only from specific IP addresses. If you don't use remote login entry points such as XML-RPC in WordPress, turn them off.
Form and spam protection
9. Add bot protection to forms. An unprotected contact form can soon start getting heavy spam; worse, some vulnerable forms can be used to send spam to others from your site. A hidden honeypot field, Google reCAPTCHA or Cloudflare Turnstile handle this without bothering visitors.
On forms with file uploads (CVs, photos), allow only the file types you need and set a size limit. Checking that an uploaded file really is an image is safer than looking at its extension.
Server-level measures
For the items in this section, you'll usually need to talk to your host or technical team.
10. SSL and HTTPS. The whole site should load over HTTPS, with HTTP requests redirected automatically. Many hosts offer a free certificate option. We explained what SSL is and how it's installed in a separate post.
11. A web application firewall (WAF). A service like Cloudflare can stop a significant share of malicious traffic before it reaches your site; check plans and prices on the service's own site. Some hosts include this in their packages. Use SFTP instead of FTP for file transfers, and don't keep file permissions wider than necessary.
12. Regular off-site backups. This is a security measure too. If the other eleven items fail one day, this is what saves you. We explained how to plan backups in our post on the 3-2-1 rule.
Where to start
If you're short on time, go in this order: two-factor authentication on your domain, hosting and email; off-site backups; deleting unused plugins and updating the rest. These three steps take an afternoon and noticeably reduce your risk from automated attacks.
If your site gets hacked despite all this, we listed the steps to follow calmly in our post on the first 24 hours.
Frequently Asked Questions
Is installing a security plugin enough?
Not on its own. Security plugins help with things like limiting login attempts and monitoring file changes, but they can't make up for an outdated plugin or a weak password. Treat the plugin as a complement to the other measures on the list.
Do these measures apply to sites not built on WordPress?
Yes, most of them. Passwords, two-factor authentication, access rights, backups, SSL and form protection apply to every platform. Items like plugin hygiene are more WordPress-specific; on custom-built sites, keeping the libraries in use up to date takes their place.
Blog posts are for general information only and are not a substitute for legal, financial or technical advice.