How to protect your website: a practical checklist

Website security has a long tail of advanced techniques, but almost all real-world compromises come down to a handful of basics being skipped. Getting these right closes off the overwhelming majority of common attacks before you need to think about anything more exotic.

Keep every piece of software up to date — your CMS, plugins, server software and any framework your site runs on. The large majority of website compromises exploit a known, already-patched vulnerability in outdated software, not some novel attack technique, which makes 'update promptly' one of the highest-leverage things you can do.

Enforce HTTPS everywhere with a valid, current certificate, use strong and unique credentials for every admin account (ideally with two-factor authentication enabled), and take regular backups stored somewhere separate from the site itself — backups are what turn a successful attack from a catastrophe into an inconvenience.

It's also worth periodically checking your own site the way a visitor's browser would: confirm any links you generate or shorten don't quietly redirect somewhere unexpected, verify your SSL certificate isn't close to expiring, and review your HTTP security headers. Small, regular checks like these catch a problem while it's still small.