Preventing a hacked website

01First understand how things go wrong

Most websites are not deliberately targeted. Automated scanners visit random addresses on the internet day and night, looking for known weak spots.

When a vulnerability is announced somewhere, those bots go looking for sites that have not yet installed the corresponding update. So you do not have to be an interesting target to become a victim. You only have to be behind.

02The practical checklist

• Keep up with updatesThe core of your CMS, themes and extensions: install security updates quickly. This is by far the most important measure.
• Use strong, unique passwordsLong and not used anywhere else, stored in a password manager. One leaked password should never open several systems.
• Switch on two-factor authenticationOn your CMS and your hosting panel. Then even with the right password, an attacker cannot get in.
• Limit the number of extensionsEvery plug-in is extra code that may contain a vulnerability. Remove what you do not use: disabled is not the same as gone.
• Choose carefully what you installOnly use extensions that are actively maintained, and never illegal versions of paid themes.
• Clean up accountsGive everyone only the permissions they need, and remove the accounts of people who have left.
• Make sure you have working backupsThey do not prevent a hack, but they determine how quickly you recover from one. See backups explained.
• Use httpsA valid certificate protects the traffic to and from your visitors. See SSL certificate and https.
• Choose solid hostingUp-to-date server software, firewalls and monitoring on your host's side head off a great deal.
• Keep an eye on thingsNotice it yourself when the site is unreachable or changes, rather than hearing it from a customer who calls you.

03Fewer components, less risk

The most fundamental measure is reducing your attack surface: anything that is not there cannot be hacked.

That is why a website without a CMS has no login page, no database and no extensions that go out of date. That removes precisely the part where most break-ins happen. For showcase websites, it is often the calmest choice; you can read the background at website that cannot be hacked.

PHP itself can go too. What that gives you in the event of a vulnerability like the one in October 2026 is explained at website without PHP.

04So is a CMS pointless?

It certainly can: a CMS is excellent if you often publish yourself. The condition is that maintenance is taken seriously.

Would you like to hand over that maintenance? Then take a look at website maintenance. You can read exactly what maintenance involves in website maintenance explained.

05Something gone wrong anyway?

No single measure gives a hundred per cent guarantee. Do you see signs of an infection? Then follow the step-by-step plan in website hacked: what now.