Website security basics

Website security affects trust, rankings, and risk. You don’t need to be an expert to understand the basics and get the fundamentals right.

Why security matters

User trust

Visitors expect secure sites. Browsers warn on HTTP and flag insecure forms.

SEO

Google treats HTTPS as a positive signal and may demote compromised or hacked sites.

Legal and compliance

GDPR and privacy expectations rely on secure handling of data.

Business reputation

A breach often costs far more than prevention.

HTTPS – the baseline

HTTPS encrypts the connection between the browser and your server. Without it:

• Data can be intercepted
• Browsers show “Not Secure”
• Google may rank you lower

Good hosting usually includes free SSL. See How SSL works. If your site still uses HTTP, fixing that is the first step.

Firewalls and malware protection

A firewall blocks malicious traffic. Good hosting typically provides:

• Application-level firewalls
• Brute-force protection
• Malware scanning
• Automated quarantine

Cheap hosting often lacks these layers. See How to choose hosting.

Backups

Backups are your recovery plan. If the site is hacked or corrupted:

• Restore from a known-good backup
• Minimise downtime
• Avoid data loss

Daily automated backups are standard on managed hosting. See Backups and recovery. A site without backups is exposed.

Passwords and login protection

Many hacks come from weak or shared credentials. Best practice:

• Strong, unique passwords
• Two-factor authentication (2FA)
• Limit admin accounts
• Don’t reuse logins across services

Software updates (WordPress)

For WordPress, keep themes, plugins, and core updated. Outdated software is a common entry point for attacks. If you don’t want to manage this yourself, a WordPress care plan can handle it. Shopify manages most updates for you.

Remove unused plugins and themes

Unused code increases risk. If you’re not using a plugin or theme, delete it. Don’t just deactivate it.

Secure hosting

Hosting is the base layer. Poor hosting usually means weaker security. Good hosting includes:

SSL

Encrypted connections. See [How SSL works](/insights/hosting/how-ssl-works/).

Firewalls

Traffic filtered before it reaches your site.

Malware scanning

Detection and quarantine of known threats.

Automatic backups

Restorable copies so you can recover if compromised. See [Backups and recovery](/insights/hosting/backups-and-recovery/).

Modern PHP versions

Up-to-date runtime with security patches.

DDoS protection

Mitigation of traffic-based attacks.

Isolated environments

Your site is not sharing a server with unknown neighbours.

See xCloud hosting.

Common mistakes to avoid

• Using “admin” as the username
• Postponing updates
• Installing plugins without checking reputation
• Ignoring SSL warnings
• Cheap hosting with minimal security
• Storing passwords or credentials insecurely

Security is foundational. When your site is secure, visitors and search engines can trust it.