Most hacked company websites are not targeted personally – they are found by automated bots scanning for known weaknesses. A few good habits block the vast majority of attacks.
1. Keep everything updated
CMS core, themes, plugins and server software (PHP, database). Outdated plugins are the most common entry point. Enable automatic minor updates and review major updates regularly.
2. Use HTTPS everywhere
A valid SSL certificate encrypts traffic and is expected by browsers and Google. Free Let's Encrypt certificates with automatic renewal are standard on our hosting.
3. Strong logins
- Unique, long passwords and a password manager
- Two-factor authentication for all admin accounts
- No shared "admin" accounts – one account per person
- Limit login attempts
4. Backups you can restore
Automatic daily backups stored separately from the server – and a tested restore. A backup you have never restored is only a hope.
5. Minimise plugins and permissions
Remove unused plugins and themes. Give editors only the permissions they need.
6. Protect forms
Spam protection (privacy-friendly captcha or honeypot), input validation and rate limits. Forms are a common target for abuse.
7. Web application firewall
A WAF or security service blocks common attacks such as SQL injection and brute-force logins before they reach your site.
8. Monitoring
Uptime monitoring, malware scanning and alerts for unusual changes so problems are noticed within minutes, not weeks.
9. Secure hosting
Isolated accounts, up-to-date server software, firewalls and a provider that reacts quickly. Hosting in Germany also supports GDPR compliance.
If your site is hacked
- Take the site offline or show a maintenance page.
- Change all passwords.
- Restore a clean backup and update everything.
- Find and close the vulnerability.
- Check whether personal data was affected – GDPR may require reporting within 72 hours.
Our Managed Hosting includes SSL, daily backups, updates and monitoring – and a team you can call if something goes wrong.