How to protect your website from malware and hackers

A small business website is not safer than a big one - automated bots scan every public IP on the internet looking for known vulnerabilities, regardless of how famous the brand is. Most "hacked website" stories are not targeted attacks; they are bots that found an outdated WordPress plugin and exploited it.

The five things that prevent 95% of compromises

1. Keep WordPress (or your CMS) up to date. Most attacks exploit known vulnerabilities for which a patch already exists. Auto-update is on by default for security releases - leave it on.
2. Update plugins and themes weekly. Same logic. Delete plugins you no longer use - inactive plugins still get exploited.
3. Use strong, unique passwords + two-factor authentication. "admin / Password123" is the single most common cause of compromise. Use a password manager.
4. Run a malware scanner. SiteLock scans your files daily and removes any malware automatically. Without scanning you might not notice a compromise for months.
5. Have working backups. Worst case, you restore. We include daily backups on every hosting plan.

What if my site has already been hacked?

Open a support ticket immediately. We will:

• Take the site offline briefly to stop further infection.
• Compare your files against a known clean snapshot and identify the malicious code.
• Restore from the most recent clean backup.
• Identify how the attacker got in and patch the vulnerability.
• Force-rotate all passwords (cPanel, FTP, database, WordPress admin, mail).
• Help you set up daily malware scanning so it does not happen again.

Active protection: Web Application Firewall (WAF)

A WAF inspects every request to your site in real time and blocks known attack patterns before they reach your code. The SiteLock Defend plan includes a WAF plus a global CDN, which has the side benefit of speeding your site up. Worth it for any site that handles user logins, payments or personal information.

See SiteLock plans Report a hacked website