Small website security: updates, passwords, backups

A small website is rarely attacked by someone who's after you in particular. Most of the time, automated programs scan the whole internet for sites running an old version of WordPress, an unpatched plugin or a weak password. Three habits keep you safe from most of it: software kept up to date, long passwords with two-step login, and a backup you've actually tried restoring at least once.

Updates: the simplest defense

New versions of WordPress, plugins and themes often fix security holes. The WordPress documentation is blunt: older versions don't get security updates, so you need to stay on the latest one. Automatic core updates have been available since version 3.7.

What to do:

• Keep automatic updates on for core and, where possible, for plugins.
• Delete plugins and themes you don't use. A deactivated plugin left on the server is still old code that can be exploited. WordPress explicitly recommends deleting it.
• Only get plugins from trusted sources. A "premium" plugin downloaded for free from a random site is the shortest path to a hacked site.
• Check monthly whether anything was left behind. Some paid plugins stop updating when the license expires.

If your site isn't on WordPress, the rule is the same: ask whoever maintains it how and how often the server software gets updated.

Passwords: long, unique, and with a second step

NIST's authentication guidelines, in the final version published in July 2025, retired a few old habits:

• a password used on its own must be at least 15 characters; with a second factor (a code on your phone, a security key), the minimum is 8;
• systems should accept passwords of at least 64 characters;
• no more rules like "one capital, one number, one symbol";
• no more forced periodic changes, only when there's evidence the password was compromised;
• new passwords get checked against a list of known, common or breached passwords;
• password managers and pasting into the password field must be allowed.

For you, that means a long passphrase or a password generated by a password manager, different for every account. Turn on two-step login for your admin account, your hosting and your domain. The WordPress documentation recommends it as an extra layer on top of a strong password.

If you want to know whether a password has shown up in a data breach, the Pwned Passwords service checks it without learning the password: only the first 5 characters of a hash computed from it ever leave your device.

Accounts: one person, one login

A single admin account shared by three people with the same password is a common problem at small businesses. Give each person their own account, with only the rights they need: someone who writes blog posts doesn't need admin rights. When someone leaves the company or a contract ends, delete their account the same day. Same for hosting and domain access.

Backups: the 3-2-1 rule, plus a test

A guide written for US-CERT, the US government's computer emergency team, sums up the 3-2-1 rule:

1. 3 copies of any important data: the original and two backups;
2. on 2 different types of storage;
3. 1 copy kept off-site.

For a website, that usually means: the copy your hosting company makes, an automatic copy sent to separate storage, and every now and then a copy you download yourself. The WordPress documentation calls for regular backups of both the files and the database.

The part almost everyone skips is the test. Every few months, restore the backup on a test site. A backup that can't be restored won't help you on the day you actually need it. We listed the monthly steps in our article on website maintenance.

If the site gets hacked anyway

1. Change the passwords: admin, hosting, database, domain.
2. Restore the last clean backup from before the attack.
3. Update everything and track down the plugin that let them in.
4. Check Search Console for any security issues Google has flagged.

The websites we build ship with these settings. See what each package includes on our web services page.