How to protect a website from hacking: baseline security measures
Most small-business hacks aren't targeted attacks — they're automated scans for known vulnerabilities. You can close the basic gaps in one day without a security specialist.
Updates: the first line of defense
If your site runs on a CMS (WordPress, Bitrix, OpenCart), enable automatic core and plugin updates, or check manually at least weekly. Over 60% of CMS hacks exploit known vulnerabilities in outdated plugins that already have a patch available.
Delete unused plugins and themes entirely rather than just deactivating them — inactive code left on the server is still an attack surface.
Passwords and access
Replace the admin password with a 16-character password from a generator, not a word plus digits. Turn on two-factor authentication for the admin panel and hosting control panel — it blocks nearly every brute-force attempt.
Limit the number of staff with admin access to the necessary minimum, and revoke access for former employees and contractors the day they leave, not when you remember. Forgotten accounts are a common cause of breaches months later.
SSL and data transfer
Make sure the site runs on HTTPS across every page, no exceptions, including payment and form pages. A free Let's Encrypt certificate covers this for most sites at no cost.
Check that old HTTP pages automatically redirect to the HTTPS version — a partial SSL setup without a forced redirect offers no protection and creates duplicate content for search engines.
Protecting forms and the admin panel
Add a captcha (reCAPTCHA v3 is invisible to users) to the lead form, login form, and any form submitting data — it blocks bots that overload the server and fill your database with spam.
Move the admin login path away from the default (wp-login.php, /admin) if the platform allows it, or restrict access by IP through hosting settings — this pulls the site out of automated scanners' sight.
Backups
Set up daily automatic backups of the database and files with at least 14 days of retention, and keep one copy off the site's own server (Google Drive, a separate cloud store). If backups only live on the same server as the site, a hack costs you both simultaneously.
Once a month, verify a backup actually restores — not that the file exists, but a real test restore on a separate subdomain. A broken backup usually surfaces at the worst possible time.
Monitoring and response
Connect free uptime monitoring (UptimeRobot or similar) with a Telegram alert when the site goes down — often the first sign of a hack before you notice visually.
Write a short incident plan: who to call (host, developer), where the latest working backup lives, who changes the passwords. Having a plan cuts downtime from a day to a few hours.