Website security for people who are not developers

Reading time: ~9 min · Published: July 2026

Most website security failures aren't dramatic hacking-movie break-ins. They're an old plugin nobody updated, a password reused from another site that leaked years ago, or a backup that turns out not to actually restore when you finally need it. None of the fixes below require coding. They require doing a handful of unglamorous things on a schedule.

HTTPS and the padlock: what it does, and what it quietly doesn't

The padlock icon in your browser's address bar means your connection to that site is encrypted — nobody sitting on the same public wifi can casually read the data passing between you and the server, and the certificate confirms you're actually talking to the domain you typed, not an impostor. That's genuinely valuable, and it's why HTTPS (versus plain HTTP) is now the baseline for every site, including a simple brochure page with no login form.

What the padlock does not mean: that the site is honest, that the business behind it is legitimate, or that the content is safe. Getting an HTTPS certificate is free and automatic for almost any domain today, so plenty of scam and phishing sites have a padlock too. Treat it as a minimum requirement, not a trust badge.

This is about to matter more directly. Google has announced that Chrome will start warning users before they load any public site that isn't on HTTPS: from April 2026 for people with Enhanced Safe Browsing turned on, and by October 2026, for everyone, by default. If your site — or an old, forgotten subdomain — is still running on plain HTTP, visitors will start seeing a warning dialog telling them the connection isn't secure before they can proceed. If you're not certain your entire site is HTTPS everywhere, that's worth checking this month, not eventually.

Keep your CMS and plugins updated

If your site runs on a content management system — WordPress alone now runs a bit over 4 in 10 websites worldwide, making it by far the most common target — every plugin, theme, and the core software itself gets security patches released regularly. Skipping updates is the single most common way small business sites get compromised: automated bots scan the internet constantly for sites still running a version with a known, published vulnerability, and they don't care how small your business is. They're not targeting you specifically; they're targeting the software.

• Turn on automatic updates for minor/security releases wherever your platform offers it.
• Remove plugins and themes you're not actually using — inactive doesn't mean safe, an unused plugin can still be an open door.
• If you're not comfortable applying updates yourself, this is a reasonable, cheap thing to pay someone to do on a monthly basis.

Strong admin access

Your login page is the front door. Treat it like one.

• Use a unique, long password for your admin account — never one reused from another site. A password manager makes this genuinely painless; you only need to remember one master password.
• Turn on two-factor authentication (2FA) wherever it's offered. It means a stolen password alone isn't enough to get in — the attacker also needs your phone.
• Audit who has admin access every so often. Former employees, an old freelancer, an agency you stopped working with two years ago — remove access the day the relationship ends, not "eventually."
• Rename or protect the default login URL if your platform allows it, since the default admin login path is the first thing automated attacks try.

Recognise the scams aimed at site owners

There's a category of phishing that targets people who own a website, not the site's visitors: an email that looks exactly like it's from your domain registrar or hosting provider, warning that your domain is about to expire or there's a problem with your billing, with a link to "renew now" or "verify your account." These messages exist to steal the login that controls your domain or hosting — arguably the single most damaging thing an attacker can get, because whoever controls your domain can point it anywhere, including somewhere that has nothing to do with you.

• Never click the link in an unexpected "your domain or account has a problem" email. Open a new browser tab, type your registrar's or host's real address yourself, and log in from there to check.
• Check the sender's actual email address, not just the display name — a message claiming to be your registrar, sent from a free consumer email address, is not your registrar.
• Set your own reminder for your domain's renewal date, so a genuine renewal notice never has to catch you off guard, and you can tell a real one from a fake one at a glance.

Backups that actually work when you need them

A backup you've never tested restoring is a hope, not a backup. The standard, well-established approach is the 3-2-1 rule: keep at least three copies of your data, on two different types of storage, with one copy stored somewhere physically separate from the original (a different server, a cloud storage account not tied to your hosting login). That last part matters most — if your only backup lives on the same server as your live site, a single hosting failure or a single compromised login can take out both at once.

• Set backups to run automatically — daily if your site changes often, weekly at minimum otherwise.
• Actually restore a backup to a test environment at least once. This is the step almost everyone skips, and it's the only way to know your backups genuinely work before the day you're forced to rely on one.
• Keep at least a few recent backup versions, not just the latest one — if an attacker or a bad update corrupts your site quietly, you may not notice for a few days.

The day you get hacked: a calm checklist

If it happens, panic wastes the time you need. Work through this in order:

• Take the site offline or into maintenance mode first, so it stops serving malicious content to visitors or search engines while you work.
• Change every password connected to the site — hosting account, CMS admin, database, FTP — starting with the ones with the widest access.
• Restore from your most recent clean backup if you have one you've verified works. This is usually faster and safer than trying to manually clean an infected site.
• Update everything — core software, every plugin, every theme — before bringing the site back online, since the same hole that let the attacker in the first time is still open otherwise.
• Check for anything left behind — new admin accounts you didn't create, unfamiliar files, unexpected redirects — since attackers often leave a way back in.
• Tell anyone who needs to know — customers whose data may have been exposed, and if relevant, check your local data-protection obligations for whether a formal notification is required.

None of this is exotic. It's the same handful of habits — encrypt, update, lock the door, back up, test the backup — repeated steadily over years. That's genuinely what separates the sites that shrug off attacks from the ones that lose weeks of work over a plugin nobody updated.