Website security basics for contractors

Why a small site still needs this

Nobody has to pick on a contractor on purpose. Automated programs scan the web for sites with old software or weak passwords, and a small site can get caught in that net. A site that has been broken into can show spam links, send visitors somewhere else, or get a warning label in the browser. Nothing makes a site impossible to break into, but the steps below lower the risk and make it easier to recover.

1. HTTPS on every page

Look at the address bar. Your site should start with https, and the browser should not say "Not secure". HTTPS scrambles what travels between the visitor and your site, including what they type into your quote form. It needs a certificate, which many hosts include at no extra charge. If yours shows a warning, ask your host or web person to turn it on and to send the old http addresses to the https ones.

2. Keep the software updated

If your site runs on a content system with themes and plugins, updates often fix known security holes. Turn on automatic updates where you can, or have someone check on a set schedule, such as once a month. If you pay for a monthly plan, ask whether updates are part of it. See what a monthly website plan should include.

3. Strong, unique passwords and two-step login

• Use a different password for the website, the hosting account, the domain account and your email. If one leaks, the others stay safe.
• Long beats clever. A password manager can make and remember them for you.
• Turn on two-step login (also called two-factor) wherever it's offered. After the password, it asks for a code from your phone.
• Protect the email account first. Password resets for everything else go there.

4. Backups you have tested

A backup is a saved copy of the whole site. Ask three questions: how often is it made, where is it kept (not only on the same server as the site), and has anyone actually restored one? A backup nobody has tested is a guess.

5. Know who has admin access

Open the user list on your site, your hosting account and your domain account. Remove past employees, old designers and agencies you no longer work with. Give each person their own login instead of sharing one, so you can remove one person without changing everything. You should hold the owner login yourself. More on that in owning your domain and website.

6. Remove old plugins and add-ons

Every plugin is more code that needs updates. Delete the ones you don't use; don't just switch them off. Be careful with plugins that haven't been updated in a long time or that came from an unofficial download.

Quick checklist

• https on every page, no browser warning
• Updates on a schedule
• Unique passwords and two-step login
• Tested backups kept off the server
• Admin list cleaned up
• Unused plugins deleted

If something looks wrong

Strange pop-ups, pages you didn't write, or a browser warning: call your host or web person right away, change your passwords from a device you trust, and ask about restoring a backup from before the problem started.