Website security

A handful of basic protections prevent most problems: keeping everything up to date, using long passwords and two-step verification, having HTTPS, making backups stored off the server and not installing plugins you don't need. Website security isn't something you buy once and forget; it's a maintenance habit, like taking the car in for its annual inspection, only more often.

Lots of people think their website is too small to interest anyone. Wrong: attacks aren't personal, they're bots that sweep the internet trying known flaws on every website they find. Another common mix-up is believing the padlock in the browser (HTTPS) makes the website secure; it only encrypts the connection. And if the website was made by an AI, the code may come with flaws nobody has pointed out to you, like keys written in plain sight or unfiltered forms. Ask the AI to review the security, but don't trust it blindly.

What hit my website from day one and the minimum protections I put in place without being an expert I explain in "Where the attacks came from when I published my website". If you're only going to do one thing today, make it this: check that you have a recent backup and that you'd know how to restore it. It's what saves you when everything else fails.