Short answer: keep your software updated, use strong, unique passwords with two-factor login, remove unused plugins and apps, keep backups off the server, run malware scanning, and use SSL. These steps prevent most website hacks. Most attacks are automated, so even small business websites are targeted every day.
Many business owners think hackers only target banks and big brands. In reality, most website attacks are automated bots scanning millions of sites for known weaknesses: an outdated plugin, a weak password, an abandoned installation. This checklist covers the steps that stop the vast majority of them.
Why websites get hacked
Attackers want your website's resources and reputation, not just your data:
- to send spam from your server,
- to host phishing pages that steal bank logins,
- to inject hidden links that sell their products,
- to redirect your visitors to scams,
- to steal customer data from forms and shops.
A hacked site can be blacklisted by Google and browsers, which warn visitors away. Recovery takes time and money; prevention takes a few habits.
The checklist
1. Update everything, every week
Outdated plugins and themes are the number one way websites are broken into. When a security flaw is fixed in an update, attackers study the fix and start scanning for sites that have not updated.
- Update WordPress (or your CMS), themes and plugins weekly.
- Turn on automatic updates for minor and security releases.
- Update PHP to a supported version in cPanel.
2. Remove what you do not use
Delete inactive plugins, unused themes, old test sites, staging copies and abandoned installs. Unused code is still reachable and still attacked, but nobody is updating it.
3. Use strong, unique passwords
- Use a password manager to generate long, unique passwords.
- Never reuse passwords between your hosting, website admin, email and bank.
- Change default usernames such as "admin".
4. Turn on two-factor authentication
Turn on two-factor authentication for your website admin (for example with a WordPress security plugin) and for your email mailboxes. A stolen password alone is then not enough to get in.
5. Give people only the access they need
Staff who write blog posts do not need administrator rights. Use the lowest role that lets each person do their job, and remove accounts as soon as people leave.
6. Keep backups somewhere else
Backups stored on the same server can be lost or encrypted along with it. Keep regular copies elsewhere:
- download full cPanel backups and store them in cloud storage,
- use a backup plugin that sends copies off the server,
- or add a backup service to your hosting.
Test restoring a backup at least once so you know it works.
7. Scan for malware
Malware often hides quietly: stealing data, sending spam or adding hidden links while your site looks normal. SiteLock scanning (₦3,000/month) checks your site regularly and alerts you to problems.
8. Use SSL everywhere
HTTPS protects logins and forms from being intercepted. It is free with SiloLobby hosting. See free vs paid SSL.
9. Add a firewall and limit login attempts
A web application firewall (often part of a security plugin) blocks common attack patterns. Limiting login attempts stops bots from guessing passwords.
10. Watch your site
- Uptime monitoring tells you when your site goes down.
- Security plugin alerts tell you about suspicious logins and file changes.
- Check Google Search Console for security warnings.
11. Avoid pirated themes and plugins
"Nulled" (pirated) premium themes and plugins frequently contain backdoors. Use free plugins from reputable sources, or buy licences.
12. Have a recovery plan
Write down where your backups are, who to call, and the steps to restore. When something goes wrong, you will not have to think.
Signs your site may be hacked
- Visitors are redirected to unfamiliar websites.
- Google shows "This site may be hacked" in search results.
- Your hosting account sends unusual amounts of email.
- New admin users or files you did not create appear.
- Your site is suddenly slow or shows strange content.
What to do if you are hacked
- Stay calm and act quickly.
- Change all passwords: hosting, website admins, database, FTP and email.
- Restore a clean backup from before the problem started.
- Update everything to close the hole the attacker used.
- Scan to confirm the malware is gone.
- Request a review in Google Search Console if your site was flagged.
- Open a support ticket. Our team can help you clean up and identify what went wrong.
A weekly and monthly security routine
Every week (15 minutes):
- Apply updates to WordPress or your CMS, plugins and themes.
- Check that the latest backup completed.
- Glance at security plugin alerts.
Every month (30 minutes):
- Remove unused plugins, themes and user accounts.
- Review who has administrator access.
- Test a backup restore on a staging copy if possible.
- Check Google Search Console for security issues.
Every year:
- Change important passwords and review two-factor settings.
- Review your hosting plan and security add-ons.
Security for online stores
Stores hold customer details and process orders, so take extra care:
- Use a hosted payment page (such as Paystack or Flutterwave checkout) so card details never touch your server.
- Limit who can view orders and customer data.
- Keep WooCommerce and payment plugins updated promptly.
- Back up orders daily.
- Watch for unusual orders that could indicate card testing, and use your payment provider's fraud tools.
Security for teams and agencies
If several people or an agency manage your website:
- Give each person their own login; never share one admin account.
- Remove access as soon as a contract ends.
- Keep the domain and hosting accounts in the business's name, with the business controlling the main login.
- Ask your agency how they store passwords and backups.
Phishing: the attack that targets you, not your website
Many website takeovers start with a fake email asking you to "verify your hosting account" or "renew your domain". Always log in by typing the address yourself, check that payment links are genuine, and enable two-factor login wherever it is offered.
Printable checklist
- Software, themes and plugins updated weekly
- Unused plugins, themes and sites removed
- Strong, unique passwords in a password manager
- Two-factor login for website admin and email
- Least-privilege user roles
- Off-server backups, tested
- Malware scanning
- HTTPS on every page
- Firewall and login limits
- Monitoring and alerts
- Recovery plan written down
Choosing security add-ons
Free plugins and good habits cover most small websites. Add malware scanning if your site is business-critical, backups if you cannot afford to lose data, and uptime monitoring if downtime costs you sales.
Summary
Most website hacks exploit the same predictable weaknesses: outdated software, weak passwords, unused code and missing backups. Work through this checklist, make updates and backups a weekly habit, and your website will be far harder to attack than most.