Preventing a hacked website

First understand how things go wrong

Most websites are not attacked deliberately. Automated scanners visit random addresses on the internet day and night, looking for known weak spots. As soon as a vulnerability is made public somewhere, those bots go hunting for sites that have not yet installed the corresponding update. So you do not have to be an interesting target to become a victim — you only have to be behind.

The practical checklist

• Keep up with updates. The core of your CMS, themes and extensions: install security updates quickly. This is by far the most important measure.
• Use strong, unique passwords. Long and not used anywhere else, stored in a password manager. One leaked password should never open several systems.
• Switch on two-factor authentication on your CMS and your hosting panel. Even with the right password, an attacker will not get in.
• Limit the number of extensions. Every plug-in is extra code that may contain a vulnerability. Remove what you do not use — deactivated is not the same as gone.
• Choose carefully what you install. Only use extensions that are actively maintained, and never illegal versions of paid themes.
• Tidy up accounts. Give everyone only the permissions they need and delete the accounts of people who have left.
• Make sure your backups work. They do not prevent a hack, but they determine how quickly you recover from one; see backups explained.
• Use https. A valid certificate protects the traffic to and from your visitors; see SSL certificate and https.
• Choose solid hosting. Up-to-date server software, firewalls and monitoring on your host's side head off a great deal.
• Keep an eye on things. Notice for yourself that the site is unreachable or has changed, rather than hearing it from a client who calls you.

Fewer components, less risk

The most structural measure is reducing your attack surface: anything that is not there cannot be hacked either. A website without a CMS has no login page, no database and no extensions that go out of date. That removes exactly the part where most break-ins take place. For presentation websites this is often the most restful choice; you can read the background at website that cannot be hacked.

So is a CMS pointless?

Far from it — a CMS is excellent when you publish yourself frequently. The condition is that maintenance is taken seriously. A well-maintained WordPress or Joomla site can be secured perfectly well; a neglected site cannot, no matter which software sits underneath. If you would like to hand that over, take a look at website maintenance or read what maintenance actually involves.

Something gone wrong anyway?

No measure gives a hundred per cent guarantee. If you see signs of an infection, follow the step-by-step plan in website hacked: what now. The faster you act, the more limited the damage.