# Website security basics: what you can do yourself

> Most attacks are automated and don’t pick their victims. Five habits that protect your website, the signs you’ve been hacked and what to do then.

Simplix · security, websites, maintenance

“Who would attack my website? I’m a small business.” It’s the most widespread illusion about security. Most attacks aren’t aimed at anyone in particular: they are programs that automatically scan millions of websites, looking for a weak password or an outdated plugin. They don’t choose you; they find an open door.

The good news is that most of these doors close with a few simple habits. Some are the job of whoever manages your website, others are yours.

## Where attacks come from

Verizon’s 2025 report, which analyzes over 12,000 confirmed breaches, shows that the most common entry points are **stolen or guessed credentials** (22%) and **unpatched vulnerabilities** (20%). On top of that, breaches involving a third party have doubled, reaching 30%[^1].

In other words: passwords, updates and suppliers. Exactly the things below.

## 1. Unique passwords and two-factor authentication

- **a different password for every account.** When some website gets hacked, the stolen passwords are tried automatically everywhere. If the same password also opens your website’s admin panel, you’ve lost;
- **a password manager**, so you don’t have to remember them;
- **two-factor authentication** wherever possible: the website’s admin, hosting, the domain, email. A Microsoft study estimated it reduces the risk of account takeover by over 99%, even when the password has already been stolen[^2]. An authenticator app is safer than an SMS code.

## 2. Timely updates

When a vulnerability is found in a popular platform or plugin, attackers look for it on every website immediately. For the most targeted vulnerabilities in the WordPress ecosystem, mass exploitation starts, on average, a few hours after they become public[^3].

- the platform, theme and plugins have to be updated regularly, not “when we have time”;
- **delete what you don’t use:** a plugin that is deactivated but still installed can still be an open door;
- the server and the programming language version need updates too.

## 3. Accounts and access only for those who need them

- everyone has their own account; no shared accounts;
- everyone has only the rights they need: someone who writes articles doesn’t need to install plugins;
- when someone leaves the company or a collaboration ends, **access is closed the same day**;
- check the list of administrators from time to time. An account you don’t recognize is a red flag.

## 4. Backups that actually work

A backup only saves you if it exists, is recent and can be restored. A simple, widely used rule:

- **3 copies** of the data,
- on **2 different media**,
- with **1 in a location** other than the server.

And the most often forgotten part: **test the restore.** A backup you’ve never tried to put back is just a hope.

## 5. Watch your suppliers and integrations

Your website is connected to other services: payments, email, maps, analytics, chat. Each has an account and access keys. Keep them somewhere safe, not in old emails, change them when someone with access leaves and drop the services you no longer use.

## Signs your website has been hacked

- Google shows a warning next to your site in search results, or the browser shows a red warning page;
- Google Search Console reports a security issue[^4];
- pages from your website that you never created appear in Google, often in another language, advertising counterfeit products;
- visitors coming from Google or on phones are sent to other websites, although when you visit directly you see nothing;
- administrators or files you don’t recognize appear;
- the server sends spam and your hosting company suspends your account;
- the website suddenly becomes slow, or traffic spikes for no reason.

> **Check your website in Search Console**
>
> Many owners only find out they’ve been hacked from their customers. A website added to Google Search Console gets alerts when Google detects hacked content or malware.

## What to do if you’ve been hacked

1. **Don’t delete everything in a hurry.** First make a copy of the current state: it’s needed to find out what happened.
2. **Change the passwords** for the website’s admin, hosting, database, email and domain, with two-factor authentication.
3. **Tell whoever manages your website** or your hosting company.
4. **Clean up and, above all, close the door.** If the cause isn’t found, the website will be hacked again, usually within days.
5. **Ask Google for a review** from Search Console, after the cleanup.
6. **If personal data was affected**, under the GDPR the incident must be reported to the data protection authority (in Romania, ANSPDCP) within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to the people concerned[^5]. If the risk is high, the affected people must be informed too.

## How we can help

For the websites we maintain, we take care of updates, tested backups, monitoring and secure access. For others, we do a security audit: we tell you what risks you have, what is urgent and what can be fixed quickly.

[Request a security audit](https://www.simplix.ro/en/services/it-consulting-and-infrastructure/)

[^1]: Verizon, [2025 Data Breach Investigations Report](https://www.verizon.com/about/news/2025-data-breach-investigations-report).
[^2]: Meyer et al., [How effective is multifactor authentication at deterring cyberattacks?](https://arxiv.org/abs/2305.00945), Microsoft, 2023: an estimated 99.22% risk reduction overall and 98.56% for accounts with already leaked credentials.
[^3]: Patchstack, [State of WordPress Security in 2026](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2026/).
[^4]: Google, [Security issues report](https://support.google.com/webmasters/answer/9044101).
[^5]: [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/eli/reg/2016/679/oj), Articles 33 and 34; [ANSPDCP](https://www.dataprotection.ro/).