Website Security: 10 Steps to Stop 95% of Attacks
Restoring a hacked site costs €800–3,000. These 10 proactive steps cost less and prevent the majority of security threats.
Author: Meiko Neuman
Founder and web strategist, Kodulehe Haldus
Who attacks a small business website?
Contrary to popular belief, it's not live hackers actively searching for your content. 99% of attacks are automated bots scanning millions of pages for vulnerabilities: - Outdated WordPress plugins - Weak admin passwords - SQL injections in forms - File-upload vulnerabilities
10 steps to a more secure site
1. SSL Certificate (HTTPS) Available for free via Let's Encrypt. Without HTTPS, Google marks the site as "insecure".
2. Strong admin password At least 16 characters. Use a password manager (Bitwarden, 1Password). Not "Admin2026!".
3. Two-factor authentication (2FA) Google Authenticator or YubiKey. For WordPress: WP 2FA plugin.
4. Keep software up to date WordPress core, all plugins, and themes. 60% of hacks are due to outdated plugins.
5. Web Application Firewall (WAF) - Cloudflare WAF (free tier available) - Wordfence (WordPress) - Sucuri
6. Change the Admin URL `/wp-admin` is the first address every bot hits. The "WPS Hide Login" plugin can change this to something like `/login-access`.
7. Brute-force protection Limit Login Attempts plugin. 3 wrong attempts = IP blocked.
8. File change monitoring If the server reports that `wp-config.php` has been modified, something is very wrong.
9. Daily backups for 90 days So you can restore to a point before the infection occurred.
10. Malware monitoring Sucuri SiteCheck (free) or Wordfence scans for malware.
What to do if your site is hacked?
- Do not panic. Do not delete anything.
- Take the site down (maintenance mode).
- Change ALL passwords (FTP, database, admin, hosting).
- Restore a backup (not an old one that might also be infected).
- Scan for malware.
- Harden security after restoration.
Recommendation: call a professional. DIY restoration often takes 3x longer and frequently leaves backdoors open.
Summary
Security isn't a matter of "if", but "when". Prevention costs €50/month; restoration costs €50/hour.
Need help with your website?
Our team maintains, optimises and protects your website. Pricing is agreed based on scope.
Request a quoteAbout the author
Meiko Neuman — Founder and web strategist, Kodulehe Haldus. Meiko leads the Kodulehehaldus team and has spent over a decade helping companies maintain and optimise their websites for measurable business results. He writes about website management, SEO, AEO/GEO and the commercial side of the web.