How do I secure my website?

Website security involves protecting your website, administrator accounts, software and visitors from common security threats. No single security measure protects every website, so use several layers of protection.

1. Keep your software updated

Keep your website platform, themes, plugins and other software updated with supported versions.

Updates can include security fixes as well as feature and compatibility improvements.

Remove software that you no longer need rather than leaving unused plugins or components installed.

2. Use strong account security

Use strong, unique passwords for administrator and hosting accounts. Enable multi-factor authentication (MFA) where your provider supports it.

Give users only the permissions they need. Avoid sharing administrator credentials between multiple people.

3. Enable HTTPS

Use an SSL/TLS certificate so your website is available over HTTPS.

HTTPS encrypts data transmitted between the visitor’s browser and the website and helps protect information from interception while in transit.

4. Protect your website with backups

Maintain regular backups of important website files and databases.

Keep backups separate from the live website where practical and make sure you know how to restore them. A backup is particularly important if your website is compromised or data is accidentally deleted.

5. Secure your hosting environment

Use a reputable hosting provider and secure your hosting account with strong credentials and MFA where available.

Review unnecessary services, accounts and access permissions. Keep server software supported and updated according to your hosting environment.

6. Protect forms and user data

Collect only information your website genuinely needs. Use appropriate validation and spam protection for public forms.

If your website stores personal information, follow the data-protection and privacy requirements that apply to your organisation and location.

7. Monitor for problems

Regularly check your website for unexpected changes, suspicious accounts, broken functionality and security warnings.

If you suspect that your website has been compromised, avoid simply deleting suspicious files. Isolate the issue, preserve relevant evidence where appropriate, change compromised credentials and follow a reliable incident-response or recovery process.

Last Updated 2nd February 2026.

Was this article helpful?

Thank you for your feedback!

We appreciate you taking the time to let us know this article was helpful.

We're sorry this article didn't answer your question.

Please let us know what was missing or contact us using the form below.

Quick notice about our knowledge base

We publish our Knowledge Base to help individuals and businesses resolve common issues across websites, advertising platforms, Salesforce and other digital systems.

We regularly review and update our guides, but the platforms, software and services covered can change without notice. As a result, screenshots, settings, features or recommended processes may differ from those available when an article was last reviewed.

The information provided is general guidance and should not be treated as advice specific to your systems or circumstances. UTDS Optimal Choice cannot accept responsibility for errors, data loss, service disruption or other issues resulting from changes made by following these guides.

If you are unsure about any of the steps, particularly where a change could affect live systems, data, tracking or business processes, we recommend speaking to us before making the change. Our team can review your specific setup and provide advice based on the current platform and configuration.

Time for some professional support?

Our team are ready to help. As one of the few digital agencies that is both a registered Salesforce Consulting Partner and Google Partner Agency, UTDS Optimal Choice is expertly positioned to support you across your entire digital landscape.