How to protect your website from hackers

Updating the theme and CMS

Think of your website's theme and Content Management System (CMS) like the operating system on your phone. Just as you eagerly await those updates to squash bugs and introduce shiny new features, your website needs that refresh too. Updating your theme and CMS closes security loopholes that hackers love to exploit, and (as a nice bonus) keeps your WordPress site running smoothly.

Update your plugins regularly

Plugins add a lot of really cool features to your WordPress website, from fancy contact forms to social media feeds. However outdated plugins are a massive security threat. WPScan found that 97% of the vulnerabilities tracked in their database were a result of plugins, with over 7000 known vulnerable plugins. So, you should be checking and updating these plugins at least once a month. This allows you to check if there are any known vulnerabilities in recent plugin updates, patch these up and keep your site's defences sharp and ready.

Delete any unnecessary plugins (and be careful about what you install)

Mo plugins, mo problems. Having a bunch of unused plugins is like hoarding old, rusty bikes in your garage. They take up space, slow you down, and, worse, could give tetanus to your website (metaphorically speaking). Keeping it clean and tidy and getting rid of old junk means less risk, less plugins to update and maintain, and of course, better security. 

And, when you're looking at installing plugins to get new features, be careful. Given the open-source nature of WordPress where any user can contribute a plugin, there are fake plugins out there waiting to infect you with malicious code. WP-Base-SEO is an example of a fake SEO plugin that did the rounds, affecting thousands of websites.

Maintain strong password security practices

Your password is the key to your digital home. Crafting strong, unique passwords for your website's various access points is crucial. Mix in upper and lowercase letters, numbers, and symbols to create a less vulnerable key.

Once you have a strong password, put it somewhere safe. Use a password management system like LastPass, Bitwarden or Passbolt, set up two-factor authentication, and limit users who can access these passwords.

Limit user access

Like we said, don't give out access to everyone. Not everyone who works in the business necessarily needs to have website access. Reducing the number of users minimises the risk of accidental or intentional breaches, keeping your site secure from both external and internal threats.

If you do need to add certain people, don't give them access to the main password. Create specific user roles, with their own login credentials, and limit the access to the tasks they need to conduct. There are several different non-admin roles you can assign:

There are several different roles you can assign to users

Contributor

This role can add content, but not delete existing content. They can edit their own posts but can't publish without approval. They also can't access the media library or upload images. 

Author

This role can influence all of their own content– writing, editing, deleting and publishing, with image access, but cannot make updates to other users' pages. 

Editor

This role is really flexible, allowing them to influence content across the site, manage content and update links.

Install security plugins

An absolute must-have is a strong security plugin like Wordfence that can do regular vulnerability scans and detect malicious attacks before they take root. It's like having a guard dog that barks when a potential intruder seems to be sniffing about. Even at its free tier, this website protection plugin has some seriously useful features, though their premium tier is worth the extra peace of mind.

Enable the HTTPS version of your site

If you're working with an SEO agency that knows its stuff, this should already be done, as websites without SSL certificates have negative SEO impacts. But if you haven't already, purchase an SSL certificate for your domain to encrypt the data exchanged between your website and its visitors, ensuring that sensitive information remains confidential and tamper-proof. It also tells your visitors their safety is your top priority.

Backup your site regularly

Regular backups are your safety net, in case of a security threat you couldn't prevent. If something happens, you can restore your website with a backup, minimising downtime and data loss. And take several backups– it's always a good idea to have your own backups even if your hosting company offers database backups as well. As an example, with Dilate hosting, we take multiple backups through multiple sources so even if one version is compromised, we've got a safety net for our safety net. 

You should backup on a daily basis if you have the capacity, or at least as often as you make key changes, to avoid losing that progress if you have to restore the old version. Keeping in mind that sometimes malicious code is hard to detect for a long time before it rears its ugly head, so the less backups you have, the further back you'll need to go.

Sign up for website maintenance services

Keeping a website as secure as you can is an ongoing battle. Signing up for a website maintenance plan means having a team of experts dedicated to ensuring your site runs smoothly and securely. They're on standby to address any vulnerabilities, apply necessary updates, and conduct routine check-ups, acting as the technical support crew that keeps your website robust and secure against potential threats.

Get a reliable hosting provider

Your choice of web hosting company makes a huge difference. Opting for a reliable hosting service is crucial, as it ensures your site remains accessible, loads quickly, and is fortified with essential security features. Look further into their hosting packages, and how their shared web servers operate. Think of it like having an apartment in a large apartment block– some nicer apartment blocks have amazing locks on the doors, security guards out front and spacious rooms, others have dingy locks that are almost falling apart, roaches in the walls and every unit is cramped up like a tin of sardines. 

If you can, go local. An Australian hosting company usually means faster server response times and better customer service.

Educate employees on cybersecurity

95% of cyber breaches are a result of human error. Educating your team on the dangers of phishing, the importance of strong passwords, and safe website practices (like making sure plugins are from reputable sources) is as important as any other internal training.