Almost nobody attacking your website has chosen you. The overwhelming majority of compromises come from automated scanners working through lists of known vulnerabilities and common passwords, hitting every address they can find. They do not know what your business does and they do not care.
That is genuinely good news, because it means the defences that matter are unglamorous and mostly free. You are not trying to stop a determined expert. You are trying to be a harder target than the automated sweep expects.
This is first because it is the entry point in most compromises we see. An attacker does not need to find a new vulnerability in your site; they only need to find an old one you have not patched.
The awkward part is that this includes things people forget they have: the core platform, plugins and extensions, themes and skins, and any libraries a developer added years ago. It also includes anything you have deactivated but not removed. Deactivated code still sits on the disk and, depending on the flaw, can still be reachable over the web. If you are not using it, delete it.
Turn on automatic updates for security releases if your platform offers them. For anything you would rather review first, put a recurring reminder in the diary. “When I get around to it” is not a patching policy.
Use a password manager and let it generate long random passwords that are different for every account. The reason unique passwords matter is credential stuffing: when some unrelated site is breached, its username and password list gets tried automatically against everything else. A reused password turns someone else’s breach into yours.
Then turn on two factor authentication anywhere it is offered, starting with your hosting control panel, your domain registrar and your site’s admin area. It is the single most effective control on this list, because it makes a stolen password insufficient on its own.
Registrar and DNS accounts deserve particular attention. Someone who controls your DNS can point your domain wherever they like and obtain certificates in your name, and no amount of hardening on the website itself helps.
If you run a CubeCart store, two factor authentication is built in and can be enabled per administrator, so you can turn it on for yourself without waiting for everyone else.
Every administrator account is another way in. Give people the lowest level of access that lets them do their job, and remove logins when someone leaves or a project finishes. Old developer and agency accounts sitting dormant with full privileges are extremely common and are exactly what a credential stuffing run is hoping to find.
Have a look at your user list now. Most people find at least one account they had forgotten about.
Backups are not a preventive measure, they are what determines whether a bad day is an inconvenience or a catastrophe. Three things make the difference:
Keep copies away from the server. A backup stored on the same machine is lost with the machine, and ransomware will encrypt it along with everything else.
Keep enough history. Compromises are often discovered weeks after they happened. If you only keep seven days, your entire retained history may already contain the problem.
Test a restore. An untested backup is a guess. Restore one to a staging site and confirm it actually works, before the day you need it.
HTTPS everywhere, with HTTP redirecting to it, and HSTS once you are confident nothing is left on plain HTTP. Certificates are free.
Sensible file permissions. Files 644, directories 755. Nothing needs to be 777, and anything set that way is usually a workaround for a permissions problem that should have been fixed properly.
SFTP or SSH, not FTP. Plain FTP sends your password across the network in the clear. Use SSH keys rather than passwords where you can.
Disable in-browser file editing. WordPress lets administrators edit theme and plugin code from the dashboard, which turns any admin account compromise directly into code execution. Adding define('DISALLOW_FILE_EDIT', true); to wp-config.php removes it.
A handful of HTTP response headers close off whole categories of attack for very little effort:
CSP is the valuable one and the one that takes real effort on a site with many third party scripts. That effort is itself informative, because it forces you to enumerate what your pages load.
Every third party script on your site is code you do not control, executing for your visitors, that can be changed without telling you. If the provider is breached, you are compromised through no fault of your own.
This matters most on pages handling payment. Open your checkout, look at the network tab, and question every external domain that appears. Marketing tags have a habit of accumulating on pages where they have no business being.
Most site owners find out they have been compromised from a customer, their payment processor, or a browser warning. Some basic monitoring closes that gap:
File integrity monitoring alerts you when files change unexpectedly. Uptime and content monitoring catches defacement. Rate limiting and brute force protection on login pages cuts off the automated password guessing that generates most of the noise. And it is worth actually reading your logs occasionally, particularly failed logins and unusual requests.
Take the site offline rather than leaving a compromised shop taking orders. Take a full backup of files and database before you clean anything, because cleaning destroys the evidence you may need. Find how they got in, or they will be back within days. Rotate every credential: admin, FTP, SSH, database, API keys.
If personal data may have been exposed, be aware that under UK GDPR a breach must be reported to the ICO within 72 hours where there is a risk to individuals. Take proper advice rather than guessing.
If you do nothing else this month: turn on two factor authentication for your hosting, registrar and site admin; delete accounts and plugins you no longer use; confirm your backups run and restore one to check; and update everything.
That is an afternoon, and it removes most of the routes an automated attack has. Everything else on this list is refinement.
If you host with us and would like a second pair of eyes on any of it, just ask.