Most attacks on business websites are not aimed at you in particular. They are automated scans that try thousands of sites an hour, looking for an outdated plugin, a reused admin password, or a form that accepts anything. That is the good news: the protections that stop them are well understood, and most of them cost little to put in place.

We first published this guide in 2018. The threats have not changed much since then, but the tools have, so here is the current version, in the order we would tackle it on a site we take over.

Encrypt every page, and make browsers insist on it

Every page should load over HTTPS, not just the login or checkout. Chrome has labeled plain HTTP pages “Not secure” since July 2018, and certificates are now free and renew automatically through services like Let’s Encrypt, so there is no reason to run without one.

  • Redirect every HTTP request to HTTPS with a permanent redirect.
  • Turn on HSTS (HTTP Strict Transport Security), which tells browsers to refuse an unencrypted connection to your site in the future.
  • Serve modern TLS only (versions 1.2 and 1.3) and retire the old protocol versions.

Put a CDN and a web application firewall in front of the site

A content delivery network (CDN) is a network of servers in many locations that keeps copies of your site’s files close to your visitors. Instead of every request traveling to your one origin server, visitors connect to a nearby data center. That makes pages faster, and it puts a large, shared network between your server and the rest of the internet.

  • Speed: shorter distances, caching, compression, and image optimization all cut load times, which visitors and search engines both notice.
  • Uptime: traffic is spread across many servers and data centers, so a hardware failure or a sudden spike does not take the site down. If one location has trouble, traffic is routed to another.
  • DDoS protection: a distributed denial-of-service attack floods a site with junk traffic. A large CDN can absorb that volume before it ever reaches your server.

Most CDNs also offer a web application firewall (WAF). A WAF inspects requests and blocks the ones that match known attack patterns, such as attempts to inject database commands or scripts, before they reach your application. Managed rule sets are updated as new vulnerabilities are published, which buys you time between a disclosure and your next update. Add rate limits on login pages and forms while you are there.

Stop bots without punishing people

The old “I am not a robot” checkbox still exists, but most sites no longer need to make every visitor click it. Invisible challenges such as reCAPTCHA v3 and Cloudflare Turnstile score traffic in the background and only interrupt the visitors who look automated. Pair them with simple measures that real people never see:

  • a hidden “honeypot” field that only bots fill in;
  • rate limits on form submissions and login attempts;
  • validation of every field on the server, never only in the browser.

Keep the software current

Most successful compromises of content-managed sites go through a known vulnerability in software that was never updated. On WordPress, the large majority of vulnerabilities reported each year are in plugins and themes rather than in WordPress itself. Custom applications have the same problem with their code libraries.

  • Apply security updates on a schedule, and urgent ones within days.
  • Remove plugins and themes you no longer use, even if they are switched off.
  • Prefer actively maintained plugins, and replace abandoned ones.
  • On custom builds, track dependencies with automated alerts.
  • Retire platforms that no longer get security fixes. Drupal 7, for example, reached end of life in January 2025; we cover moving off it on our web development page.

Lock down the way in

A stolen password is the easiest way into any system, so protect every login that can change your site, not only the CMS.

  • Give each person their own account. No shared admin logins.
  • Require two-factor sign-in for the CMS, hosting, DNS and registrar, and email.
  • Grant the least access each role needs: editors rarely need administrator rights.
  • Remove accounts the day someone leaves, including contractors and agencies.

Plan for the bad day: backups and monitoring

Even a well-run site can be hit, so make recovery routine rather than heroic.

  • Take automated backups at least daily, store them away from the web server, and keep several versions so a quiet infection can be rolled back past.
  • Test a restore. A backup you have never restored is a guess.
  • Monitor uptime, scan for malware and unexpected file changes, and alert on events such as a new administrator account.

Add the headers that protect visitors

Security headers are short instructions your server sends with every page, telling the browser what it may and may not do. They take an afternoon to configure and close off whole categories of attack.

  • Content-Security-Policy: limits where scripts and other resources can load from, which blunts cross-site scripting.
  • frame-ancestors (or X-Frame-Options): stops other sites from framing yours to trick visitors into clicks.
  • X-Content-Type-Options, Referrer-Policy, Permissions-Policy: small settings that prevent file-type tricks and limit what leaks to other sites.

Free scanners such as Mozilla’s HTTP Observatory will grade your current headers in a few seconds.

Don’t forget the domain and email

Your domain is the root of everything else. If someone takes control of it, they control your website and your email.

  • Turn on registrar lock and two-factor sign-in at your registrar, and set domains to renew automatically. Expired domains are bought and abused.
  • Use DNSSEC where your registrar and DNS host support it.
  • Publish SPF, DKIM, and DMARC records so others cannot send email as your domain. Since February 2024, Google and Yahoo have required this kind of authentication from bulk senders.
  • Watch for lookalike domains registered to imitate yours. Our domain and brand protection service monitors for them.

A short checklist

  • HTTPS everywhere, with HSTS
  • CDN and web application firewall in front of the site
  • Invisible bot protection, rate limits, and server-side validation
  • Updates on a schedule; unused plugins removed
  • Personal accounts, two-factor sign-in, least privilege
  • Off-server backups, tested restores, monitoring and alerts
  • Security headers in place
  • Registrar lock, auto-renew, DNSSEC, SPF, DKIM, and DMARC

Where we come in

We manage 547 client domains today, and keep sites current on ongoing support plans: updates, monitoring, backups, and fixes. For a deeper look at an existing site, or at the AI tools connected to it, see Security & AI Risk, or tell us about your site.