Security is one of those topics that gets explained in two unhelpful ways: either it's dismissed ("you're too small to be a target") or it's made to sound so terrifying that you don't know where to start. We're going to try a third approach.
The truth is somewhere in the middle. Yes, security matters — but most of what you need to do is straightforward, and doing it well doesn't require a security background. We've been protecting websites for years, and we want to share what actually makes a difference.
Let's go through it together.
The mindset shift that helps everything else
Most website security incidents aren't targeted attacks by sophisticated hackers specifically after your data. They're opportunistic — automated bots scanning the web for easy targets. Outdated plugins, weak passwords, missing SSL — these are the open doors that get walked through.
This is actually good news. It means that doing the basics well protects you against the vast majority of threats. You don't need to be impenetrable — you just need to not be an easy target.
SSL certificates: the non-negotiable first step
If there's one thing you take from this guide, let it be this: every website needs an SSL certificate, full stop.
SSL (Secure Sockets Layer) encrypts the connection between your website and your visitors. It's what puts the padlock icon in the browser bar and makes your URL start with https:// instead of http://. Without it, any data sent through your site — contact forms, login details, payment information — travels unencrypted and can be intercepted.
Why it matters beyond security
Google has made HTTPS a ranking factor. Sites without it rank lower than sites with it. Browsers like Chrome actively warn visitors when they land on non-HTTPS sites, displaying messages like "Not Secure" in the address bar. Many visitors will leave immediately when they see that — and rightly so.
How to get it
Every TPC Hosting plan includes a free SSL certificate via Let's Encrypt. It's activated automatically. If you're on a different host and don't have SSL, contact them — any reputable provider includes this for free. If they charge extra for it, that's a red flag worth noting.
Backups: the thing that saves everything
We've all had that moment — something breaks, something gets deleted, something goes wrong — and the first thought is "please let there be a backup."
Backups are the single most important insurance policy for your website. They don't prevent problems from happening, but they turn disasters into inconveniences. A hacked site with a clean backup from yesterday is recoverable in minutes. A hacked site without any backup is potentially gone forever.
What good backup practice looks like
- Daily automated backups — Set and forget. Every reputable host offers this. If yours doesn't, switch.
- Multiple backup locations — Your backup shouldn't only live on the same server as your site. If that server has a hardware failure, you lose both. Store backups offsite — cloud storage, a different server, or both.
- Test your backups — A backup you've never tested is a backup you don't know works. Periodically restore a backup to a staging environment to make sure the process actually works.
- Keep multiple restore points — If you keep only yesterday's backup, and the problem started three days ago, you're stuck. Aim for at least 7-14 days of backup history.
Before any major change
Before updating WordPress, installing a new plugin, or making significant changes to your site — take a manual backup. Even if you have automated backups running, having a specific "before I changed X" restore point can save you a lot of frustration.
Passwords and access: keeping the wrong people out
Weak passwords are responsible for a staggering proportion of website breaches. And the most common passwords in the world are still things like "password123" and "admin". We're not going to judge — we're going to help you fix it.
What a strong password actually looks like
Long is more important than complex. A random 20-character string is vastly stronger than a shorter "clever" password with substitutions. The easiest approach: use a password manager (Bitwarden is free and excellent, 1Password and Dashlane are also great) to generate and store completely random passwords. You don't need to remember them — you just need to remember one master password.
Two-factor authentication
Two-factor authentication (2FA) adds a second layer of verification when you log in — usually a code from an app on your phone. Even if someone has your password, they can't get in without also having your phone. Enable this on your WordPress admin, your hosting control panel, your domain registrar — anywhere that matters.
Limit who has access
Only give people the access they actually need. In WordPress, this means using the right user roles — a content writer doesn't need admin access. When someone leaves your team, remove their account immediately. Dormant accounts with old passwords are a risk you don't need.
Change default usernames
The default WordPress admin username is "admin". Automated attacks specifically try this username first. If you're still using it, change it. Create a new admin account with a different username and delete the old "admin" account.
Common threats explained simply
Understanding what you're protecting against makes it easier to know what matters. Here are the threats most relevant to small and medium business websites.
Brute force attacks
Automated bots try thousands of username and password combinations against your login page, hoping to get lucky. The fix: strong passwords, 2FA, and a plugin like Wordfence or Limit Login Attempts that blocks IP addresses after too many failed attempts.
Malware and malicious code injection
If an attacker gains access to your site, they often inject code that redirects visitors to other sites, steals data, or turns your server into a spam machine. Regular malware scans catch this. Wordfence (free tier) scans your WordPress files regularly and alerts you to anything suspicious.
Phishing targeting your customers
Attackers sometimes create fake versions of your site to trick your customers into entering their credentials. While you can't fully prevent this, having a clear domain, HTTPS, and email authentication (SPF, DKIM, DMARC — more on this in our Domains & Email guide) makes it harder for attackers to convincingly impersonate you.
DDoS attacks
Distributed Denial of Service attacks flood your server with traffic until it becomes unavailable. For most small business sites, the risk is relatively low — and services like Cloudflare's free tier provide basic DDoS protection that handles the vast majority of attack traffic before it even reaches your server.
Outdated software vulnerabilities
This is by far the most common vector for small business website compromises. An outdated WordPress plugin with a known vulnerability is like an unlocked door — automated tools scan for these constantly. Keep everything updated. It's boring advice, but it's the right advice.
GDPR and privacy: what you actually need to do
If you have visitors from the European Union — and if your site is in English or targets European markets, you almost certainly do — you have legal obligations under GDPR. Here's the practical version, without the legal fog.
Privacy policy
You need one. It should explain what data you collect, why you collect it, how you use it, and how visitors can request its deletion. Many tools (including website builders and hosting control panels) include privacy policy generators — use one as a starting point, but make sure it actually reflects what your site does.
Cookie consent
If your site uses cookies — and if you're running analytics, social sharing buttons, or advertising, it does — you need to ask for consent before setting non-essential cookies. This is what those cookie banners are for. They're not optional in the EU. A plugin like CookieYes or CookieBot handles this cleanly.
Contact form data
When someone fills in your contact form, you're collecting personal data. Make sure your privacy policy mentions this, and only keep the data as long as you need it. Don't build up a database of enquiries and never delete anything — that's unnecessary data retention.
Third-party tools
Every third-party service you use on your site — Google Analytics, Facebook Pixel, live chat tools — processes visitor data. Check the GDPR compliance of each service you use and make sure your privacy policy lists them.
Security tools worth knowing
You don't need to do all of this manually. Here are the tools that do most of the heavy lifting.
- Wordfence — WordPress security plugin with malware scanning, firewall, and login protection. The free tier covers most small sites.
- Cloudflare — Free CDN and security layer that filters malicious traffic, provides basic DDoS protection, and improves performance.
- Sucuri — Website security monitoring and malware removal service, good for higher-risk sites or after a security incident.
- Bitwarden — Free, open-source password manager for strong, unique passwords across all your accounts.
- Google Search Console — Free tool from Google that alerts you if your site is flagged for malware or security issues.
A practical starting checklist
If you want to start today, here's the order we'd recommend:
- Check your SSL is active and working (visit your site and look for the padlock)
- Make sure automated daily backups are running (check with your host)
- Change any weak or default passwords on your WordPress admin and hosting account
- Enable 2FA on your WordPress admin login
- Install Wordfence and run a malware scan
- Install Cloudflare (free tier) if you haven't already
- Check and update all WordPress plugins, themes, and core
- Make sure you have a privacy policy and cookie consent in place
You don't have to do all of this in one sitting. Work through it over a week. But don't put it off indefinitely — the question isn't whether security problems happen. It's when, and whether you're ready.
We're on your side
At TPC Hosting, security isn't an afterthought — it's built into how we run our infrastructure. From automated backups to SSL certificates included on every plan to our 24/7 monitoring, we work to make sure the hosting layer is as secure as it can be.
But hosting security and site security are both important — and both are your responsibility. The steps above are the site security side. We've got the hosting side covered. Together, you've got a strong foundation.
If you ever suspect something is wrong with your site, don't wait — contact our support team immediately. We've helped many customers through security incidents and we know what to look for. You don't have to deal with it alone.
