10 Essential Tips to Secure Your Website

The ones that matter most

1. Keep everything updated: core, plugins, themes.
2. Use a password manager and a different password per service.
3. Turn on two-factor authentication wherever it is offered.
4. Remove plugins and themes you do not use. Unused code still runs.
5. Take backups you have actually restored once.
6. Serve the whole site over https.
7. Limit administrator accounts to the people who need them.
8. Do not reuse your hosting password anywhere else.
9. Watch for unexpected files in your web root.
10. Have a plan for who you call, before you need to call them.