Most hacked websites are not targeted; they are simply easy. Ten practical habits that make yours a much harder target.
Small business owners often tell us “nobody would bother hacking my website”. Unfortunately, most attacks are not personal. Automated tools scan the internet around the clock for websites with old software or weak passwords, and break into whatever they find. The aim is to not be the easy one.
1. Keep everything updated
Out-of-date software is the most common way in. Update your CMS, plugins and themes promptly, and remove the ones you no longer use. Our guide Updating WordPress safely shows how to do it without breaking anything.
2. Use long, unique passwords
Every login, from your hosting to your website admin and your mailboxes, should have its own long password. A password manager makes this painless.
3. Turn on two-step verification
Turn on two-step verification wherever it is offered, starting with your hosting account and your email. A stolen password alone is then not enough. In your Twerple client area, it is under Security & 2FA.
4. Give people only the access they need
Your copywriter does not need to be an administrator. Create separate accounts with the lowest role that does the job, and remove them when the work is finished.
5. Always use HTTPS
An SSL certificate encrypts everything between your visitors and your website, including logins and payment details. Every Twerple hosting plan includes a free one. Make sure all visitors are sent to the secure version: see Forcing HTTPS and turning on HSTS.
6. Turn on the firewall
A web application firewall blocks common attacks before they reach your website. Our guide Protecting your website with the web application firewall explains how to turn it on.
7. Scan for malware
Run a malware scan regularly, and straight away if your website starts behaving oddly or your host warns you. See Scanning your website for malware.
8. Keep backups you have tested
Backups are your way back from the worst day. Make sure they run, that copies are kept somewhere other than your website, and that you have tried restoring one. More on that in our post on the 3-2-1 backup rule.
9. Be careful with free themes and plugins
Only install software from its official source. “Free” copies of paid themes and plugins from unofficial websites are a classic way to get malware.
10. Watch your email
Many break-ins start with an email asking you to “confirm your login”. Your host will never ask for your password by email. When in doubt, sign in by typing the address yourself instead of clicking a link.
If the worst happens
Change your passwords, restore a clean backup, update everything and scan again. If you are a Twerple customer, open a ticket and we will help you work out what happened and how to close the door behind it.