Website Security: How to Protect Your Site from Hacking and What to Do If It’s Been Hacked

Most websites aren’t hacked by someone hunting for you specifically, but by automated scripts. They scan millions of sites around the clock looking for an outdated plugin, a weak password or an exposed admin panel. So protecting a website from hacking is mostly about discipline: updates, access, backups. The basic level stops most attacks, and a business owner can keep an eye on it without technical knowledge.

Below: what websites are most often hacked through, a security checklist for businesses, how to tell your site has already been hacked, and what to do in the first hours.

Why ordinary company websites get hacked

A small company website seems like an uninteresting target, but attackers don’t want your data so much as your server and your reputation in Google. A hacked site is used to:

• host spam pages (casinos, pills, counterfeits) and rank them on the strength of your domain;
• redirect visitors to scam sites;
• send spam from your server;
• steal data from forms: contacts, and in online stores, payment information.

For WordPress sites, the most common CMS, the numbers make the picture clear. According to the Patchstack report, 7,966 new vulnerabilities were found in the WordPress ecosystem in 2024. 96% of them were in plugins and 4% in themes, while WordPress core had only seven, none of them a mass threat. So the main risk isn’t WordPress as such, but the number and quality of plugins and the theme.

The main threats in plain words

A fuller list of typical web application vulnerabilities is maintained by the international community OWASP Top 10, the standard reference for developers.

A website security checklist for business owners

You don’t need to understand servers, but you should know which of these your site already has. Ask your contractor about each item.

1. Backups. Automatic, daily or weekly, files and database. Stored separately from the site, not on the same server. And most importantly: someone has checked at least once that the site can actually be restored from a backup.
2. Updates. The CMS, theme and plugins are updated regularly, not “some day”. Unused plugins are deleted, not just deactivated.
3. Access. Everyone who works in the admin panel has their own account with the minimum rights they need. There’s no shared “admin” login for the whole team. Former employees and contractors are removed.
4. Two-factor authentication for all administrators of the site, the hosting and the domain registrar.
5. HTTPS on every page. An SSL certificate encrypts data between the visitor and the site. Without it, the browser shows a warning and forms send data in plain text.
6. Protection from bots and attacks. A web application firewall (WAF) and a CDN filter suspicious traffic before it reaches the site.
7. Monitoring. A service that alerts you if the site goes down, plus Google Search Console, which warns you about detected security issues.
8. The domain and hosting are registered to the company, and you hold the access to them, not only your contractor.

Official recommendations for hardening WordPress are in the WordPress documentation.

Why off-the-shelf themes and plugins are the main risk

Hacks are rarely done by hand. Automated scripts look for sites running a specific vulnerable version of a popular theme or plugin, and the more popular the product, the more sites are exposed at once. A template site with thirty plugins means thirty third-party products whose updates someone has to track.

We build WordPress sites without off-the-shelf themes or page builders and install only the plugins we can’t do without. That doesn’t make a site invulnerable (nothing does), but it sharply reduces the amount of third-party code your security depends on. The same approach also makes a site faster, as we wrote in our article on website loading speed.

How to tell your website has been hacked

A hack often isn’t visible on the home page. Warning signs:

• Google shows pages of your site on unrelated topics; check with the query site:yourdomain.com;
• Search Console shows a message in the Security issues report;
• the browser or Google warns visitors that the site is unsafe. You can check the domain’s status in Google Safe Browsing;
• visitors on phones or from search get redirected to other sites, even though everything opens normally for you;
• unknown users have appeared in the admin panel, and your host reports spam being sent or unusual load.

What to do if your website has been hacked

1. Don’t delete anything in a hurry. First make a copy of the current state: you’ll need it to find out how the attackers got in.
2. Notify your hosting provider and, if you have one, switch your CDN to its heightened protection mode.
3. Change all passwords: admin panel, hosting, database, FTP, email, domain registrar. Remove unknown users.
4. Restore the site from a clean backup made before the hack, and immediately update everything that can be updated.
5. Find and close the entry point. If you don’t, the site will be hacked again the same way, often within days.
6. Ask Google to review the site through the Security issues report in Search Console to remove the warning for visitors.
7. If customer data has leaked, work out who is affected and let them know. If you handle data of people in the EU, the GDPR (Article 33) requires notifying the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach. In other countries the rules differ, so check the ones that apply to you.

Security is a process, not a launch setting

A site that’s secure at launch becomes vulnerable after a year without updates: new holes are found in plugins every day. So agree in advance who is responsible for updates and backups after launch (your team, the agency or the host) and how quickly that person responds if something happens.

If your site is old, on an outdated theme and with dozens of plugins, patching it can cost more than rebuilding it. How to tell it’s time for a redesign is covered in our article on signs your website is outdated.