Website security essentials
The few habits that prevent most problems.
- Update everything: your CMS, themes, plugins and server software.
- Use strong, unique passwords and two-factor authentication everywhere it's offered.
- Keep backups outside your hosting, and test restoring them.
- Use HTTPS on every page.
- Give people only the access they need, and remove it when they leave.
- Install software only from trusted sources.
- Watch for warning signs: unknown admin users, unexpected redirects, spam sent from your domain, or a sudden drop in search traffic.
See also Securing WordPress, Keeping your server secure and our free Security basics for site owners course.