Insights · Care · 5 min read · Updated October 2026
Keeping your website safe from hackers: the 2026 guide
An easy checklist for business owners. No scare stories, just the habits that keep attackers out.
Most hacked websites were never picked out by a person. They were found by automated bots that scan the internet day and night, looking for an old plugin, a weak password or a forgotten test copy of a site.
That is good news. Bots look for easy targets, so a few steady habits move your site off their list.
We have written it with WordPress in mind, since it powers a large share of business websites. Most steps apply to any site, including Shopify stores and custom builds.
Why small business websites get hacked
Attackers rarely care about your website itself. They want what it can do for them: send spam, host fake login pages, redirect your visitors to scam sites, steal customer details or use your server to attack others.
The usual ways in are simple. Plugins and themes with known holes that were never updated. Weak or reused passwords. Old user accounts nobody removed. Forgotten copies of the site sitting on the same hosting.
The cost is real. Google can show a warning to anyone who finds you in search, your host can suspend the account and you can lose customer trust that took years to build.
1. Use strong passwords and turn on two factor login
Every account that controls your website needs its own long, unique password. That means your WordPress logins, hosting panel, domain registrar, email and any FTP or database access. A password manager makes this painless.
Then add a second step. Two factor authentication asks for a code from an app on your phone, so a stolen password alone is not enough. Many hosts, registrars and email providers now support passkeys too, which are even safer. Turn on whichever is available for every admin.
Finally, limit login attempts. A security plugin or your host can block an address after a few failed tries, which stops bots from guessing password after password.
2. Keep WordPress, plugins and themes up to date
Outdated plugins and themes are the most common way into a WordPress site. When a security hole is found, the fix is released as an update and the details become public. From that moment, bots go looking for every site that has not updated yet.
WordPress installs its minor security releases automatically by default. For plugins and themes you trust, switch on automatic updates from the Plugins and Themes screens. For big updates, such as a new major version of WordPress or WooCommerce, take a backup first. If your site is busy or heavily customised, test the update on a staging copy before it goes live.
Do not forget the server itself. Ask your host which PHP version your site runs. Older versions stop receiving security fixes. In 2026, PHP 8.3 or newer is a sensible choice.
3. Delete what you do not use
Every plugin and theme is code that can carry a security hole, even when it is switched off. Deactivating is not enough. Delete the plugins and themes you do not use.
Keep one default WordPress theme as a fallback. If your site uses a child theme, keep its parent theme installed and updated.
Check for abandoned plugins too. On the Plugins screen, click View details to see when each one was last updated. If a plugin has not been updated in about a year or has been removed from WordPress.org, replace it with an active alternative.
Never install pirated or nulled premium themes or plugins. They are free for a reason: many come with malware already inside.
4. Find forgotten copies and old test sites
An old test install, a folder called old, a backup zip left in the website folder or a staging site nobody updates: attackers love these because nobody watches them. One infected copy can spread to every other site on the same hosting account.
Open your hosting panel and list every site and folder. Delete what you no longer need, along with its database. If you are unsure, download a copy to your computer first, then delete it from the server. Never leave backup files inside the public website folder, where anyone who guesses the name can download them.
5. Tidy up users and roles
Give every person their own login. Shared logins make it impossible to know who did what or to remove one person's access.
Avoid usernames like admin or your business name, since bots try those first. Give each user the lowest role that lets them do their job. Someone who writes blog posts needs Author or Editor, not Administrator.
When a staff member leaves or an old agency finishes its work, remove the account the same day. Every few months, open the Users screen and check for anyone you do not recognise.
6. Back up every day and keep a copy off the server
A backup will not stop a hack, but it turns a disaster into an inconvenience. Set up automatic daily backups of both your files and your database.
Keep at least one copy away from your hosting account, such as in cloud storage. Some attacks and some server failures wipe the backups stored on the same server. Keep a few weeks of history too, because infections can go unnoticed for a while.
Then test a restore every few months. A backup you have never restored is a hope, not a plan.
7. Add a firewall and switch on monitoring
A web application firewall blocks known attack patterns before they reach your site. You can add one through a security plugin such as Wordfence. A service like Cloudflare can also filter bad traffic before it reaches your server.
Make sure the whole site runs on HTTPS with a valid SSL certificate. Most good hosts include one free.
Then make sure you hear about problems early. An uptime monitor tells you when the site goes down. A security plugin can email you when files change or malware is found. Google Search Console, which is free, alerts you if Google finds malware or hacked pages on your site.
8. Protect the accounts around your website
Your website is only as safe as the accounts that control it. Lock your domain at the registrar and turn on two factor login there.
Protect the email inbox that receives password reset links. Whoever controls that inbox can reset everything else.
Ask your developer or host to set up SPF, DKIM and DMARC records for your domain. They make it much harder for criminals to send emails that pretend to come from you.
Your quick security checklist
- Passwords. Long, unique passwords and two factor login on every admin, hosting, domain and email account.
- Updates. WordPress, plugins, themes and PHP kept up to date.
- Clean up. Unused plugins, themes and old test sites deleted.
- Users. One login per person, with the lowest role they need.
- Backups. Daily backups stored away from the server, with a tested restore.
- Protection. Firewall, HTTPS and regular malware scans switched on.
- Alerts. Uptime monitoring and Google Search Console set up.
Think your site is already hacked?
Warnings in Google, visitors sent to strange sites or admin users you never created all mean it is time to act. Our step by step malware removal guide shows how to clean a site safely.