How to Keep a Small Website Secure and Updated

Most small websites that get hacked aren't targeted. They're found by automated bots looking for weak passwords and software that hasn't been updated. If you keep your logins strong, keep your software current and keep backups somewhere else, you've dealt with the large majority of the risk. The rest is a short monthly routine.

How much work this takes depends on how your site is built. A hosted website builder handles the software and servers for you. A static site has very little to attack. A self-hosted CMS, such as WordPress, puts most of the job on you.

Lock down your logins

Your accounts are the front door. That includes the website builder or CMS admin, your hosting control panel, your domain registrar and the email address that receives password resets for all of them.

• Use a different, long password for each account. A password manager makes this painless and remembers them for you.
• Turn on two-factor authentication everywhere it's offered. An authenticator app or a passkey is stronger than text message codes.
• Secure the email account first. Anyone who controls it can reset every other password.
• Give each person who edits the site their own account, with only the permissions they need. Remove accounts when people leave, which matters a lot for clubs with rotating volunteers.
• Don't use "admin" as a username on a CMS.

Keep software updated

Updates fix security holes that attackers already know about. Once a fix is public, bots start scanning for sites that haven't installed it.

On a CMS, that means the core software, your theme and every plugin. Turn on automatic updates where your CMS and host support them, at least for security and minor releases. For major updates, take a backup first.

Hosting software matters too. Choose a host that keeps its server software and PHP versions current. If your control panel warns that your site runs an old PHP version, take it seriously.

Static sites need less attention, but if you use a static site generator, update it and its dependencies every so often, especially when the tool reports a known vulnerability.

Use fewer plugins and themes

Every plugin is code written by someone else that runs on your site. Old, abandoned plugins are a common way in.

• Install only what you need, from the official directory or a developer you trust.
• Check when a plugin was last updated before installing it. Long silence is a warning sign.
• Delete plugins and themes you aren't using. Deactivated isn't enough, because the files are still there.
• Never install "free" copies of paid themes or plugins from unofficial sites. They often include malware.

Turn on HTTPS and keep it on

HTTPS encrypts the connection between your visitors and your site, and browsers warn people away from sites without it. Most hosts and builders now provide free certificates that renew automatically. Certificate lifetimes are getting shorter across the industry, so automatic renewal matters more than it used to. Check the padlock now and then, and set your site to redirect plain HTTP to HTTPS.

Back up, and store copies elsewhere

A backup is your undo button for hacks, bad updates and accidental deletions. Good backups are:

• automatic, running daily or weekly depending on how often you change things
• stored away from your hosting account, so one breach or billing problem doesn't take both
• tested, which means you've restored one at least once and know it works

If you use a builder, export what you can and keep your text and photos in a folder on your computer. For a static site, your files in a Git repository plus a copy on your computer are your backup.

Don't lose your domain

An expired domain takes your site and email down at once, and someone else can register it after the grace periods pass. Turn on auto-renew, keep a working card on file, and keep the registrar lock enabled so the domain can't be transferred without your approval. Our domain guide explains renewal and transfer rules.

Watch for spam and strange changes

Contact forms and comment sections attract spam. Use your tool's spam protection, and turn comments off if you don't need them.

Signs your site may be compromised include pages you didn't create, links to pharmacy or gambling sites, redirects to unfamiliar sites, warnings in search results or browsers, and alerts from your host. Search engines' free webmaster tools will notify you about some of these problems, so set them up.

A 15-minute monthly routine

Put a recurring reminder in your calendar and work through this list:

1. Install any pending updates, after confirming a recent backup exists.
2. Delete plugins, themes and user accounts you no longer need.
3. Check that the latest backup ran and is stored off-site.
4. Visit the site on a phone. Click the main links, send yourself a test form message, and check for the padlock.
5. Glance at your webmaster tools for security or crawl warnings.
6. Confirm the domain's expiry date and that auto-renew is on.

Once a year, review who has access to everything, update your passwords if any were shared, and restore a backup to a test location to prove it works.

Questions