Most successful attacks exploit predictable weaknesses: outdated software, reused passwords and unprotected login pages. Keeping everything patched, turning on two-factor authentication, running an SSL certificate and a web application firewall, and testing that your backups actually restore covers the common cases. In the UK a breach involving personal data may need reporting to the Information Commissioner's Office within 72 hours.
On this page ▾
Website security means the practices that protect a site from unauthorised access, data theft and disruption. Most successful attacks do not involve sophisticated technique. They exploit predictable weaknesses: outdated software, reused passwords and unprotected login pages.
For a UK business the consequences reach past a temporary outage. A breach involving personal data may need reporting to the ICO within 72 hours under UK GDPR. Hacked sites also lose search rankings and visitor trust, and both take longer to recover than the site itself.
This is a checklist of the measures that address the most common attacks, plus the UK-specific frameworks that turn informal good practice into something you can demonstrate to a client or an auditor. None of it requires specialist knowledge. It does require consistency.
Keep all software current
Outdated software is the most common entry point. When a vulnerability is found in a CMS, plugin or theme, the developer releases a patch, and the window between public disclosure and you applying it is when you are most exposed. The vulnerability is documented by then, which means it is also weaponised.
Enable automatic updates wherever the platform offers them. Apply the same discipline to your own devices, since keeping your operating system and browser current reduces the risk of credentials being taken at your end rather than the server’s. For custom-built components, the equivalent is secure coding practice, which reduces the attack surface before a vulnerability exists to patch.
If you run WordPress specifically, the plugin ecosystem is where nearly all of the risk sits, and it needs its own treatment. See our guide to WordPress security for the detail.
Use strong credentials and two-factor authentication
Credential stuffing takes username and password pairs leaked from other breaches and tests them automatically against new targets. If you reuse passwords, a breach somewhere else can expose your hosting panel, CMS and email at the same time.
Strong passwords are long, random, and not built from personal information or dictionary words. A password manager is what makes unique passwords on every account practical rather than aspirational.
Enable two-factor authentication (2FA) anywhere it is offered, and treat it as mandatory on admin accounts rather than optional. It adds a second verification step so a compromised password alone is not enough to get in. Of everything on this list, it delivers the most protection for the least effort.
Install an SSL certificate
An SSL certificate enables HTTPS, encrypting data in transit between your server and your visitors. Without it, anything submitted through a form travels in plain text and can be intercepted, including login credentials and payment details. Browsers flag sites without it as “Not Secure”, which costs you trust before a visitor reads a word.
Enabling HTTP Strict Transport Security (HSTS) tells browsers to always use HTTPS, which prevents downgrade attacks that would otherwise expose an unencrypted connection. Free Let’s Encrypt certificates cover most requirements. For sites handling payment card data, a paid certificate with extended validation may be more appropriate, and SSL certificates are the route for that.
Add a web application firewall
A web application firewall (WAF) filters traffic between the internet and your site, blocking requests matching known attack patterns before they reach your application. That covers SQL injection, cross-site scripting, volumetric attacks and requests from addresses already known to be malicious.
Cloudflare offers WAF functionality at the DNS level, so malicious traffic is filtered before it reaches your server at all. Many WordPress security plugins, Wordfence included, bundle a WAF instead. Your hosting provider may also offer network-level DDoS mitigation as standard, which is worth checking rather than assuming.
A firewall catches known patterns. It does not close the underlying hole, and for anything custom-built you need both:
- Parameterised queries and prepared statements are the correct defence against SQL injection. They treat user input as data rather than executable code, so injection fails regardless of what is submitted.
- Input validation and sanitisation filters submitted data before it is processed, narrowing the surface further.
The firewall covers you at the network level while the code-level fix is what actually removes the vulnerability. On any site accepting form submissions, both are necessary.
Back up regularly, and test the restore
Backups do not prevent attacks. They determine how fast you recover from one. Ransomware, defacement and ordinary human error all become survivable when a recent clean copy exists. A backup stored only on the same server as the site offers very little protection if that server is what got compromised.
The 3-2-1 formula is the usual framework: three copies of your data, on two different media types, with one copy offsite. Applied practically, your live site is one, a local backup is the second, and an offsite copy in separate cloud storage is the third.
Aim for daily backups held somewhere other than your hosting account, and test a restore. A backup you have never restored from is an assumption, not a safeguard. Ask your provider whether automated backups are included and what the retention period actually is, because those two answers vary far more than people expect.
Limit login attempts and tighten access
Brute force attacks cycle through password combinations until one works. Limiting failed attempts before temporarily blocking the address cuts that off cheaply, and most security plugins handle it as standard.
Review accounts and permissions periodically. Access tends to accumulate: people change roles, contractors finish projects, and nobody revokes anything. Remove accounts that are no longer needed so that access reflects current reality.
If your hosting panel or admin area does not need to be reachable from every address on the internet, allowlisting specific addresses adds a layer that is difficult to bypass even with valid credentials.
The UK framework: NCSC and Cyber Essentials
UK businesses have government-backed guidance that is often more directly applicable than US-focused security advice. The National Cyber Security Centre (NCSC) publishes free, practical material, and its Small Business Guide covers much the same ground as this checklist.
The Cyber Essentials scheme is a government-backed certification verifying your defences against the most common attacks. It requires five technical controls: firewalls, secure configuration, user access control, malware protection and patch management. Those map almost one to one onto this article, which is a useful way to check your own coverage.
Certification is priced by organisation size rather than as a single fee. A micro organisation of nine people or fewer pays roughly £300 to £350 plus VAT, rising through about £400 to £450 for a small business, £450 to £500 for medium, and £550 to £600 for 250 people or more. It renews annually. Cyber Essentials Plus is a separate proposition: it adds a hands-on technical audit, is priced by the assessor according to how complex your environment is, and commonly runs into the low thousands. Confirm current figures with a certification body before budgeting, since the tiers are reviewed periodically.
For businesses bidding on government contracts, Cyber Essentials is already a requirement in many procurement frameworks. For everyone else it is a recognised baseline that communicates security maturity without needing to explain your setup from scratch.
Three further frameworks are worth knowing by name:
- ISO/IEC 27001 is the international standard for information security management, relevant if you handle sensitive data at scale.
- PCI DSS applies to any site processing or transmitting payment card data, and sets requirements for network architecture and encryption.
- PECR requires clear consent before deploying cookies or analytics scripts, and sits alongside UK GDPR rather than replacing it.
Where to start
If the list above is longer than your available time, the order that removes the most risk fastest is: turn on two-factor authentication for every admin account, enable automatic updates, and confirm you have a backup you have actually restored from. Those three cover credential attacks, the patching window and recovery, which between them account for most of what goes wrong.
Everything after that is refinement, and refinement is a lot easier to schedule than a recovery. Working toward Cyber Essentials is a reasonable way to structure it, because it gives you an external deadline and a checklist someone else wrote, which is usually what turns security from an intention into a completed task.
