Keep everything updated
Outdated plugins, themes and frameworks are the most common entry point for attackers. Schedule regular updates.
Protect access
Use strong unique passwords, multi-factor authentication and separate accounts for each team member.
- Remove unused admin accounts
- Never share hosting passwords over chat
- Store API keys outside public code
Validate every input
Forms must be validated on the server and protected against spam, injection and cross-site request forgery.
Have a recovery plan
Automated off-site backups and a tested restore process turn a disaster into an inconvenience.