Website security: 7 minimum measures you can't skip

One day your site loads with a red browser warning. Or a customer calls to say a strange ad is popping up on your homepage. This is not a Hollywood-style hack with scrolling green code — it is almost always a plugin nobody updated, a weak password, and a backup that never actually existed.

Small business sites get hit precisely because nobody is choosing them personally. Bots scan thousands of addresses in a row and walk through the first unlocked door they find. And the damage doesn't stop at one page: once Google flags a site as compromised, that label follows the entire domain across search, not just the page that got breached.

There's a quieter cost on top of that: once a visitor sees a "not secure" warning, they rarely try again — they just open a competitor's site instead. That loss never shows up in any report, because nobody writes to tell you why they left.

Why this becomes an SEO problem

Google Safe Browsing protects billions of devices every day and shows a warning before a visitor opens a site it considers dangerous. By its own description, the service also notifies the site owner when it detects a compromise, so the problem can be found and fixed — but the warning is already live by then, and the traffic does not come back until the issue is resolved and re-checked.

There's a second, quieter version of the same damage: an attacker plants hidden links or a malicious script inside your code. The page looks normal to a visitor while a search engine crawls something else entirely. Months of SEO work can be wiped out in one night, because rebuilding trust takes far longer than restoring a file.

7 minimum measures

1. Automated backups stored somewhere else

A simple question: if your site got hacked today, how many hours back could you restore? If the answer is "not sure," you don't actually have a backup. Your host's default snapshot usually isn't enough on its own — it typically lives on the same server, so it disappears along with the site if that server is compromised. Keep at least one copy in a separate location — cloud storage, a separate account — and actually test the restore process from time to time instead of assuming it works. An online store, for example, has order data changing every day — if a weekly backup isn't enough, switch to a daily automated one.

2. Keep the CMS, plugins and server software updated

An outdated version is the single most common way in. The OWASP Top 10 — the industry-consensus list of the most critical risks to web applications — shows the same already-known, already-patched vulnerabilities near the top year after year. The threat isn't new; nobody installed the fix. Always take a fresh backup right before updating, so a failed update doesn't turn into a second problem on its own.

3. Lock down who can log in

The admin panel is the first thing bots try. A default username, a reused weak password, and no two-factor step together make automated password guessing genuinely easy. Use a password manager with a separate, long password for every account, and turn on a second verification step everywhere it's available. Avoid shared logins, too — everyone should have their own account, so that if something goes wrong you can tell whose access was actually used.

4. Watch your SSL certificate's expiry

The padlock in the address bar isn't a cosmetic detail — it encrypts every exchange between your site and its visitors. Nonprofits like Let's Encrypt issue it for free and automatically — its certificates already secure more than 700 million websites worldwide — so a missing certificate is no longer an excuse. Never let one lapse: it damages both trust and ranking at the same time.

5. Put a firewall and bot filter in front of the site

A firewall running at the server or CDN level blocks suspicious requests before they ever reach your site. It won't stop every attack, but it filters out the bulk of automated bots and takes real load off your server. Many hosting providers and CDNs already offer this as a built-in feature — you usually don't need to buy a separate tool, just switch it on.

6. Keep user permissions to the minimum needed

Don't hand every account admin rights — an editor needs content access, a bookkeeper needs reports, nothing more. The more people with full access, the higher the odds that one weak password or one forgotten account turns into an expensive problem. Revoke a departing employee's access the same day — it's the single most commonly forgotten step.

7. Set up monitoring

You should learn about a problem before your customer does. The "Security Issues" report in Google Search Console shows what Google itself has already detected, and uptime monitoring tools flag unexpected changes or downtime. Both are free, and setting them up is a one-time job. Route the alerts to email or chat so you're not checking the site manually several times a day just to be sure.

A hacked site isn't a story about restored files — it's a site that lost Google's trust, and earning that back takes far longer than restoring a backup.

If you're already hacked: the first hour

Panic is the first enemy; wasted time is the second. In order: take the site offline or switch it to maintenance mode, change every password — admin, hosting, FTP, database — restore the last backup you know is clean, then request a review through Search Console. Before restoring, check for any newly created admin accounts you don't recognize — attackers often leave one behind as a backdoor, and deleting the malicious file alone isn't enough. Tell your hosting provider too — sometimes the extra step needed sits at the server level, not the site's. If you can't move through all of that quickly on your own, every hour is lost traffic and lost trust.

Don't treat this as a one-time task

None of these seven measures is technically hard, but doing all of them, on time, without forgetting — that's a separate discipline, especially as a site grows. That's why many businesses fold it into our ongoing support and maintenance service instead of a one-off job — updates, backups and monitoring keep running in the background without anyone having to remember.

You can check your site's technical health, including whether the certificate is set up correctly, in a couple of minutes with our free audit tool.