How to protect your website from hackers

The advice on protecting your website from hackers often gets presented as a long checklist. The problem is that not all items on that list carry equal weight. A small number of measures account for the majority of attack vectors that lead to real compromises, and knowing which ones to prioritize makes the difference between effective security and the appearance of it.

Attacks against websites are almost entirely automated. Scanners probe millions of sites at once, testing for known vulnerabilities in software versions, common passwords, and exposed configuration files. A site does not need to be high-traffic or well-known to be targeted. It needs only to be online and running something with a known flaw. For the full context on what is at stake when these measures are not in place, see the article on why website security is important.

How to protect your website from hackers through strong authentication

Credential attacks are among the most common ways attackers gain access to websites. A strong password on its own is not enough. What actually stops automated brute force tools is combining a strong password with rate limiting and a second authentication factor.

Strong and unique passwords

• Admin account passwords should be long, random, and unique to the site. Not reused from any other service
• Short passwords and passwords based on common words or patterns are tested first by automated brute force tools, which can attempt thousands of combinations per minute
• A password manager generates and stores strong credentials without requiring you to memorize them

Two-factor authentication

• Two-factor authentication requires a second verification step beyond the password when logging into the admin panel
• Even if a password is stolen through a data breach or phishing attack, two-factor authentication prevents the attacker from using it without also controlling the second factor
• Enabling it on every admin account is one of the highest-impact single changes available for website security

Login attempt limits

• Brute force tools work by testing thousands of passwords in rapid succession. A limit on the number of failed login attempts before locking out an IP address stops this approach
• Many website platforms include login attempt limiting as a built-in setting or through a security extension

Removing unused accounts

• Every active admin account with a weak or reused password is a potential entry point
• Accounts created for former employees, contractors, or developers should be removed as soon as they are no longer needed

How to protect your website from hackers through software hygiene

Outdated software is the most exploited vulnerability category across websites. When a security flaw is found and patched, the details are typically published alongside the patch. Sites still running the old version are then a documented, known target.

Apply updates as soon as they are available

• Updates to the website platform, plugins, themes, and integrations should be applied promptly. Security patches are frequently included, and delaying leaves known vulnerabilities open
• Setting updates to apply automatically where possible eliminates the risk of missing a critical patch

Remove unused plugins and themes

• Inactive plugins and themes that are not kept updated remain vulnerable even when they are not active on the site
• Removing them reduces the attack surface without affecting anything on the live site

Only use software from trusted sources

• Plugins, themes, and extensions from unofficial sources are a common vehicle for malware distribution
• Using only software from the platform's official marketplace or from reputable, established developers reduces the risk of installing pre-infected code

How does HTTPS protect your website?

An SSL certificate and HTTPS are baseline requirements. They protect data in transit and signal to search engines that the site meets minimum security standards. For full details on how to set one up, see the article on what an SSL certificate is and how it works.

What HTTPS does

• HTTPS encrypts data visitors submit through forms, login pages, and checkout processes, preventing it from being read if intercepted in transit
• The SSL certificate also verifies the site's identity, protecting against some forms of traffic interception and impersonation

What HTTPS does not do

• HTTPS does not prevent attacks on the site itself. SQL injection, cross-site scripting, brute force login attempts, and malware injection are not stopped by HTTPS
• It is one layer of protection, not a substitute for the others

How does a web application firewall help?

What it does

• A web application firewall sits between incoming traffic and the website, inspecting requests before they reach the server
• It filters out requests matching known attack patterns, including SQL injection attempts, cross-site scripting payloads, and traffic from known malicious sources
• Attacks that never reach the server cannot exploit vulnerabilities in the site's code

Network-level versus application-level firewalls

• Network-level firewalls filter traffic at the infrastructure level before it reaches the server. These are typically provided by hosting companies and CDN providers
• Application-level firewalls operate at the site level and can be more specific about which requests to allow based on the site's content and behavior
• Both types serve different purposes and can be used together

Why backups are part of protecting your website from hackers

No security measure eliminates all risk. When something does get through, a clean backup is what determines how fast you recover and how much you lose.

What backups do that prevention measures cannot

• Ransomware attacks that encrypt the site's files are far less damaging when a recent clean backup exists. Restoring from backup removes the attacker's leverage entirely
• A clean backup also provides a verified reference point to compare against when trying to identify what an attacker changed

What makes a backup useful

• Backups must be stored separately from the site's server. A backup on the same server is compromised or encrypted along with everything else in an attack
• Backup frequency should match how often the site changes. A site updated daily needs daily backups
• Testing that a backup can actually be restored is as important as having the backup. A backup that fails on restore is not a backup

For a complete guide on setting up and managing website backups, see the article on how to back up your website. For what to do if malware is already on your site, see the article on what website malware is and how to remove it.

How WEMASY handles website protection

WEMASY's hosting infrastructure includes firewall protection and DDoS mitigation at the network level. SSL certificates are included on every plan and applied automatically, so all sites are served over HTTPS by default. Software updates are managed at the platform level, removing the responsibility for patching from the site owner.

Backups are included on all plans and managed automatically, with restore options available through the dashboard. Two-factor authentication is available for WEMASY account access, and login activity is monitored at the platform level.

See what is included at the WEMASY website builder, or review plan options on the pricing page.

Frequently asked questions