How to Keep Your Website Secure

Quick answer: Keep software updated, use strong unique passwords with two-factor login, give access only to people who need it, use SSL, and keep daily off-site backups. Most hacks exploit outdated software or reused passwords.

The essentials

Update promptly. Website software, themes and plugins publish fixes for known weaknesses; attackers scan for sites that haven't applied them.
Strong, unique passwords for the website, hosting, domain and email, stored in a password manager.
Two-factor authentication on every admin login that offers it.
Least access. Give each person their own login with only the access they need, and remove it when they leave.
SSL everywhere, so logins and forms are encrypted.
Backups kept off the server.

Protect your forms

Forms attract spam bots. Use a bot check, such as Cloudflare Turnstile, server-side validation and rate limiting so one visitor can't send hundreds of submissions. Only ask for the personal information you actually need.

Signs your site may be compromised

Pages redirect to strange websites, or Google shows spam in your results
New admin users you didn't create
Your host or Google Search Console warns you about malware
Emails from your domain are being rejected as spam

If you are hacked

Change all passwords: website, hosting, domain and email.
Restore a clean backup from before the hack, or have the site cleaned.
Update everything and remove unknown users or files.
Check Search Console for security issues and request a review once clean.
If personal information may have been exposed, consider your POPIA obligations to notify the Information Regulator and affected people.