Securing your website is a lot like locking your front door at night. It protects your business, your information and, most importantly, your visitors’ trust. Here are eight essentials for keeping your website safe.
Hosting
Choosing a web host is like picking a safe neighborhood for your home. A good host adds layers of protection, like watching for suspicious activity, scanning for malware, using firewalls to block attacks and making regular backups. Cheap hosting often skips some of these, which leaves your site more exposed.
Our Website Management Plans include secure web hosting and ongoing maintenance, so your website is protected as well as beautiful and functional.
Updates
Hackers are always looking for weak spots in websites, and updates are how those weak spots get fixed. Keeping WordPress, your theme and your plugins up to date is one of the most important things you can do to keep your site secure. (Here’s why it’s important to keep your website updated.)
SSL certificate
An SSL certificate encrypts the information traveling between your visitors’ browsers and your website, so things like contact form messages and passwords can’t be read along the way. It’s what puts the “s” in “https.” Without one, most browsers label your site “Not secure,” which can scare visitors away and hurt your search rankings. Most good hosts include SSL certificates for free. (Technically, SSL has been replaced by a newer version called TLS, but most people still call it SSL.)
Passwords
A strong password is your first line of defense. Length matters more than odd symbols, so a long passphrase made of several random words is both strong and easy to type. Use a different password for every account, so one leak doesn’t unlock everything. A password manager can create and remember them all for you.
Two-factor authentication (2FA)
Two-factor authentication adds a second lock to your door. After you enter your password, you also confirm it’s really you, usually with a code from an app on your phone. Even if someone steals your password, they still can’t get in. An authenticator app is safer than codes sent by text message, which can sometimes be intercepted.
Access
Only give out house keys to people you trust, and only the keys they need. WordPress lets you assign roles, so a content writer can manage blog posts without being able to change the rest of the site. Give each person their own login instead of sharing one, and remove accounts for former employees or developers as soon as they no longer need access.
Content Security Policy (CSP)
A Content Security Policy is like a guest list for your website. It tells visitors’ browsers which sources your site trusts for things like scripts, fonts and images. If someone manages to slip harmful code onto your site from somewhere else, the browser blocks it. Setting up a CSP is fairly technical, so it’s best handled by your developer or hosting provider.
Backups
A backup is a copy of your website’s files and database that you can restore if something goes wrong, whether it’s a hack, a bad update or a simple mistake. Good backups are automatic, stored somewhere other than your website’s server and tested now and then to make sure they actually work.
5 things you can do today
- Run any pending updates. Check for WordPress, theme and plugin updates.
- Switch to unique passwords. Store them in a password manager.
- Turn on two-factor authentication. Start with your website, email and hosting accounts.
- Remove logins nobody uses. Delete or downgrade old accounts.
- Confirm your site is backed up. Find out where your backups are stored and how often they run.
Keep your website safe
Website security doesn’t have to be overwhelming. Focusing on these eight essentials goes a long way toward protecting your site and your visitors, and when it comes to security, prevention is always easier than cleanup.
We build every website with security in mind, and our Website Management Plans keep it updated and protected, so you can focus on running your business.
Add your first comment to this post