Website security basics: what a new site actually needs

Nobody is singling out your bakery's website. Automated tools scan millions of sites a day for three things: login pages that accept reused or weak passwords, plugins and themes with a known security hole, and forgotten copies of software that never get updated. When they find one, they inject spam links, redirect visitors elsewhere, or use your server to send junk email.

That's good news, because it means boring, regular habits stop most attacks. You don't need a security budget; you need a checklist you actually follow.

On shared or cloud hosting the work is split. Knowing the line stops you assuming someone else is doing your part.

In rough order of how much trouble each one prevents.

1. 1Turn on SSL and force HTTPS. Free on Hostinger; here's how.
2. 2Use a unique password for the hosting account, the site admin and the domain. A password manager makes this painless. Reused passwords are the most common way in.
3. 3Switch on two-factor login for your hosting account and your site's admin area.
4. 4Update everything, then keep it updated. Turn on automatic updates for minor WordPress releases and for plugins you trust.
5. 5Delete plugins and themes you don't use. Deactivated plugins can still be attacked while their files sit on the server.
6. 6Give each person their own login with the lowest role that does the job, and remove people who've left.
7. 7Check your backups (next section), and download one copy somewhere off the server.

Security is about reducing the odds. Backups are what you fall back on when the odds go against you, or when an update simply breaks the site. Hostinger's entry plans keep weekly backups; Business and the cloud plans keep daily ones. Premium vs Business vs Cloud Startup has the full comparison.

For a site that changes rarely, weekly is fine. For a store taking orders every day, losing up to a week of orders is not, which is the main reason I point shops at Business or higher.

• Know where they are. In hPanel, open the website and find Backups; note how far back they go.
• Keep one copy elsewhere. Download a full backup (files plus database) monthly, or use a backup plugin that sends copies to cloud storage.
• Restore once on purpose. Restore a backup to a staging copy or a test subdomain, so you know the process before a real emergency.
• Back up before big changes, such as theme switches, major updates or a migration.

Check quickly if you see any of these:

• Visitors (often on mobile only) are redirected to another site.
• Google shows spam titles for your pages, or Search Console sends a security warning.
• Admin users you don't recognise, or posts you didn't write.
• Your host suspends email sending, or the site suddenly slows down for no reason.

Don't panic and don't start deleting files at random. Work through it in order. The hPanel tour shows where the security and backup tools live.

1. 1Change every password: hosting account, site admin users, database and FTP.
2. 2Run the malware scanner in hPanel's security section, and contact Hostinger support with what you found.
3. 3Restore a clean backup from before the infection, if you have one.
4. 4Update WordPress, every plugin and theme, and remove anything you don't use.
5. 5If Google flagged the site, request a review in Search Console once it's clean.

A hacked site is often a slow one, and a site stuffed with plugins is both slower and easier to break into. If your site feels sluggish, this diagnosis checklist helps, and if you've genuinely outgrown shared hosting, here's how to tell.

SaveMores is an independent Hostinger referral site. If you buy through a link here we may earn a commission, at no extra cost to you. That's why a coupon button appears on this page, and it's why I also say where Hostinger is the wrong choice. The disclosure page and how we test explain the rest.