How to protect my website from hackers (2026)
Quick Answer
To protect your website from hackers, focus on the basics first: keep your software updated, use strong authentication, back up the site, and reduce what attackers can reach. Then add layers such as HTTPS, a web application firewall, security scanning, and least-privilege access. Good website security is mostly about routine maintenance, not a single product or setting.
Overview
Website security works best as a layered process rather than a one-off fix. Most successful attacks exploit known weaknesses: outdated software, weak passwords, poorly configured hosting, unsafe plugins, or stolen login details. A practical defence therefore starts with an inventory of what runs your site, then closes the easiest routes in: admin accounts, plugins, forms, file permissions, and exposed services. After that, you add controls that limit damage if something does go wrong, such as backups, logging, malware scans, and a web application firewall. For most site owners, the right approach is to secure the hosting account, the content management system or framework, and the people who can log in. If you run WordPress, Joomla, Drupal, Magento or a custom-built site, the exact menus differ but the principles are the same. You should also think about privacy and legal duties, because a hacked website can expose customer data, send spam, serve malware, or damage search rankings. This guide covers the practical order to follow so you reduce risk quickly without relying on guesswork or expensive tools you may not need.
Who this is for
Website owners, small business operators, bloggers, ecommerce managers, and administrators responsible for a hosted website or web application.
What you’ll need
- Administrator access to your website, hosting control panel, domain DNS, and CMS or framework
- A current list of plugins, themes, extensions, integrations, and user accounts
- A reliable backup method you can restore from
- Strong unique passwords stored in a password manager
- Multi-factor authentication for admin accounts where supported
- Access to your hosting provider's security settings, logs, and support
Before you start
Check who hosts the site, what software it runs, and who has access. Confirm you can take a backup and restore it. If the site may already be hacked, preserve logs if possible, change passwords from a clean device, and avoid making uncontrolled changes before you have a recovery plan.
Step-by-step
- 1
List what needs protecting
Identify your hosting provider, domain registrar, CMS or framework, server type, plugins or extensions, themes, integrations, payment tools, and all admin accounts. Note which parts are publicly accessible and which staff or contractors can log in.
Why: You cannot secure systems you have forgotten about. Old plugins, unused admin accounts, and abandoned subdomains are common entry points.
- 2
Update the core software and remove what you do not use
Update the CMS, framework, plugins, themes, server packages, and any libraries according to the vendor's official guidance. Remove unused plugins, themes, demo content, old staging sites, and anything no longer maintained by its developer.
Why: Many attacks target known vulnerabilities that already have patches. Unused components increase attack surface and often go unpatched.
- 3
Lock down logins and access
Use strong unique passwords for hosting, CMS, database, FTP or SFTP, and domain accounts. Enable multi-factor authentication for all admin and editor accounts if available. Remove shared logins, disable accounts for former staff, and give each person the minimum access they need. Prefer SFTP or SSH over plain FTP.
Why: Stolen or reused credentials are a major cause of compromise. Limiting privileges reduces the damage a single account can cause.
- 4
Turn on HTTPS and harden the hosting environment
Install a valid TLS certificate and force HTTPS for the whole site, including admin areas. In your hosting panel, disable services you do not need, restrict database access, review file permissions, and keep secrets such as API keys and database credentials out of public web directories where possible.
Why: HTTPS protects data in transit and helps stop credential theft on insecure networks. Basic server hardening reduces easy wins for attackers.
- 5
Set up backups, logging, and monitoring
Create automatic backups of files and databases and store copies away from the live server. Test that you can restore them. Enable access logs, error logs, and any security alerts offered by your host or platform. Monitor for unexpected file changes, new admin users, failed logins, and unusual traffic spikes.
Why: If prevention fails, recovery speed matters. Backups and logs are essential for restoring service and understanding what happened.
- 6
Add protective layers for web attacks
Use a web application firewall or managed security service if your host or platform supports it. Enable rate limiting, bot protection, spam controls, and brute-force protections for login pages and forms. Validate and sanitise user input if you manage custom code.
Why: These controls help block common attacks such as brute force attempts, malicious bots, and exploitation of vulnerable forms or scripts.
- 7
Scan regularly and review after every change
Run malware or vulnerability scans using your host, platform tools, or reputable security tooling. After installing a plugin, changing code, or moving hosts, review logs, test forms and payments, and check that security settings still apply.
Why: Websites change constantly. Regular checks catch problems introduced by updates, developers, or compromised components.
- 8
Prepare an incident response plan
Document what to do if the site is hacked: who to contact, how to take the site into maintenance mode, how to restore from backup, how to rotate passwords and keys, how to notify affected users if required, and how to verify the site is clean before bringing it back online.
Why: A calm, rehearsed response limits downtime, data loss, reputational harm, and repeated compromise.
Why this works
Website attacks usually succeed through a small number of predictable weaknesses: unpatched software, poor authentication, excessive access, insecure code, and lack of recovery planning. Layering updates, access control, encryption, monitoring, and recovery measures means an attacker has to defeat multiple controls instead of just one.
Common mistakes to avoid
- Assuming your host secures everything for you without checking what is your responsibility
- Keeping unused plugins, themes, test scripts, or old subdomains online
- Using one admin login for several people or failing to remove ex-staff access
- Taking backups but never testing a restore
- Installing security plugins while ignoring updates and password hygiene
- Using plain FTP instead of SFTP or SSH
- Treating malware cleanup as complete without finding the original entry point
Troubleshooting
You keep seeing repeated failed login attempts
Enable multi-factor authentication, rate limiting or brute-force protection, review exposed usernames, and change weak or reused passwords.
The site was restored but gets hacked again
Patch the original vulnerability, rotate all passwords and keys, remove unknown admin users, rescan plugins and themes, and check for backdoors left in files or scheduled tasks.
After enabling security rules, parts of the site stop working
Review firewall or plugin logs, temporarily disable the rule causing false positives, and then create a narrower exception rather than turning off protection entirely.
Search engines warn that the site is dangerous
Take the site out of service if necessary, clean or restore it, patch the cause, then follow the relevant search engine's review process once you are confident the site is clean.
Compare your options
Managed hosting security features
Best for: Site owners who want provider-level help with updates, firewalls, backups, and monitoring
Pros: Convenient, often simpler to maintain, support may help during incidents
Cons: Less control, features vary by provider, may not protect insecure plugins or poor user access decisions
CMS security plugin or extension
Best for: Popular CMS sites where you want extra login protection, scanning, and alerts
Pros: Easy to add, often gives visibility into common issues
Cons: Quality varies, can slow the site or conflict with caching, not a substitute for secure hosting and updates
Cloud web application firewall or CDN security service
Best for: Sites exposed to high traffic, bots, scraping, or repeated web attacks
Pros: Can block malicious traffic before it reaches the server, may improve resilience and performance
Cons: Needs correct configuration, can create false positives, usually another service to manage
| Option | Best for | Pros | Cons |
|---|---|---|---|
| Managed hosting security features | Site owners who want provider-level help with updates, firewalls, backups, and monitoring | Convenient, often simpler to maintain, support may help during incidents | Less control, features vary by provider, may not protect insecure plugins or poor user access decisions |
| CMS security plugin or extension | Popular CMS sites where you want extra login protection, scanning, and alerts | Easy to add, often gives visibility into common issues | Quality varies, can slow the site or conflict with caching, not a substitute for secure hosting and updates |
| Cloud web application firewall or CDN security service | Sites exposed to high traffic, bots, scraping, or repeated web attacks | Can block malicious traffic before it reaches the server, may improve resilience and performance | Needs correct configuration, can create false positives, usually another service to manage |
Alternatives
- Use a fully managed website platform that handles hosting, updates, TLS, and much of the security stack for you
- Hire a security-minded web developer or managed service provider to harden and maintain a custom site
Pro tips
- Create a monthly security checklist so updates, account reviews, and backup restore tests actually happen
- Use separate admin accounts for day-to-day editing and for full administration
- Change default admin usernames where practical and disable XML-RPC or similar legacy interfaces only if you do not need them
- Keep a record of every plugin or integration's purpose, owner, and update status
- Review your site after staff changes, redesigns, migrations, and new marketing tools
Safety notes
- If you suspect compromise, change passwords from a clean device rather than from the possibly infected one
- Do not download unknown 'nulled' themes, plugins, or scripts; they are a common malware source
- Be careful when editing server or firewall settings on a live site, because mistakes can lock out users or break transactions
Legal & regulatory notes
If your website stores or processes personal data, a security incident may trigger breach notification, contractual, and privacy obligations depending on your country and sector. Check the guidance from your national data protection authority, your payment provider, and any cyber insurance policy. If you take card payments, follow your payment provider's security requirements and any applicable PCI DSS responsibilities.
What this guide does not cover: This guide gives general website security steps and does not replace vendor-specific instructions for your hosting platform, CMS, server stack, payment setup, or custom application code.
Cost considerations
The cheapest improvements are usually updates, account cleanup, password management, and tested backups. Ongoing costs may include managed hosting, a firewall or CDN service, monitoring tools, developer time, and incident response support. The right spend depends on the site's value, traffic, stored data, and downtime risk.
Frequently asked questions
Is HTTPS alone enough to protect my website?+
No. HTTPS protects data between the visitor and the site, but it does not fix vulnerable plugins, weak passwords, poor access control, or insecure code.
How often should I update my website software?+
As promptly as practical, especially for security updates. Check the vendor's release notes and test updates in staging if the site is business-critical.
Do small websites get hacked too?+
Yes. Many attacks are automated and look for any vulnerable site, not just large brands.
What is the first thing to do if I think my site has been hacked?+
Preserve access if you can, change passwords from a clean device, put the site into maintenance mode if needed, and restore only after you identify and patch the cause. If personal data may be affected, check your legal notification duties.
Should I use a security plugin?+
It can help, especially on common CMS platforms, but it is only one layer. Updates, backups, strong authentication, and secure hosting matter more.
Sources & references
Guidance on this page is traced to documented sources. Last checked 25 September 2026.
- National Cyber Security Centre · government
Supports practical cyber security basics for small organisations, including passwords, backups, updates, and access control.
- OWASP Web Security Testing Guide · industry
Supports web application security principles such as testing for common vulnerabilities, authentication weaknesses, and secure configuration.
- OWASP Top 10 · industry
Supports the need to address common web application risks including broken access control, insecure design, and vulnerable components.
- CISA Secure by Design Alerts and Guidance · government
Supports general defensive guidance on patching, multifactor authentication, incident response, and reducing exploitable weaknesses.
The core principles stay stable, but tools, attack methods, CMS settings, and hosting features change regularly.