# Website security basics: what a new site actually needs URL: https://www.savemores.store/guides/website-security-basics Author: Mr. Ahmed · Published 2026-10-28 · Updated 2026-10-28 · Hosting basics ## Short answer - Most small sites aren't hacked by a person; they're hit by bots trying stolen passwords and known holes in old plugins. - Five habits block most of that: SSL, updates, unique passwords with two-factor login, fewer plugins, and backups you've actually restored once. - Your host handles the server; you're responsible for the site, its logins and its plugins. - A backup you've never restored is a hope, not a plan. Test one before you need it. ## How small sites really get hacked Nobody is singling out your bakery's website. Automated tools scan millions of sites a day for three things: login pages that accept reused or weak passwords, plugins and themes with a known security hole, and forgotten copies of software that never get updated. When they find one, they inject spam links, redirect visitors elsewhere, or use your server to send junk email. That's good news, because it means boring, regular habits stop most attacks. You don't need a security budget; you need a checklist you actually follow. ## What your host covers, and what's on you On shared or cloud hosting the work is split. Knowing the line stops you assuming someone else is doing your part. | Area | Who handles it on shared/cloud hosting | What you do | | --- | --- | --- | | Server software and operating system | The host | Nothing | | Network attacks and DDoS filtering | The host | Nothing | | SSL certificate | The host provides it | Switch it on and force HTTPS | | WordPress, plugins and themes | You | Update them and remove unused ones | | Passwords and admin accounts | You | Unique passwords, two-factor login, few admins | | Backups | The host keeps some | Know how often, and keep your own copy too | > From the bench: On a VPS the line moves: the server is yours too, including updates and the firewall. If that's you, do [the ten-minute VPS hardening](https://www.savemores.store/vps/secure-new-vps) before anything else. ## The checklist: do these in the first week In rough order of how much trouble each one prevents. 1. **Turn on SSL and force HTTPS.** Free on Hostinger; [here's how](https://www.savemores.store/guides/install-ssl-on-hostinger). 2. **Use a unique password for the hosting account, the site admin and the domain.** A password manager makes this painless. Reused passwords are the most common way in. 3. **Switch on two-factor login** for your hosting account and your site's admin area. 4. **Update everything, then keep it updated.** Turn on automatic updates for minor WordPress releases and for plugins you trust. 5. **Delete plugins and themes you don't use.** Deactivated plugins can still be attacked while their files sit on the server. 6. **Give each person their own login** with the lowest role that does the job, and remove people who've left. 7. **Check your backups** (next section), and download one copy somewhere off the server. ## Backups: the thing that saves you when everything else fails Security is about reducing the odds. Backups are what you fall back on when the odds go against you, or when an update simply breaks the site. Hostinger's entry plans keep weekly backups; Business and the cloud plans keep daily ones. [Premium vs Business vs Cloud Startup](https://www.savemores.store/compare/premium-vs-business-vs-cloud-startup) has the full comparison. For a site that changes rarely, weekly is fine. For a store taking orders every day, losing up to a week of orders is not, which is the main reason I point shops at Business or higher. - **Know where they are.** In hPanel, open the website and find Backups; note how far back they go. - **Keep one copy elsewhere.** Download a full backup (files plus database) monthly, or use a backup plugin that sends copies to cloud storage. - **Restore once on purpose.** Restore a backup to a staging copy or a test subdomain, so you know the process before a real emergency. - **Back up before big changes,** such as theme switches, major updates or a migration. > From the bench: The worst call I get is "we were hacked, and the backups only go back three days, all infected." Hacks are often found weeks late. One older copy kept off the server is what turns a disaster into an afternoon. ## Signs your site may already be compromised Check quickly if you see any of these: - Visitors (often on mobile only) are redirected to another site. - Google shows spam titles for your pages, or Search Console sends a security warning. - Admin users you don't recognise, or posts you didn't write. - Your host suspends email sending, or the site suddenly slows down for no reason. ## If you've been hacked Don't panic and don't start deleting files at random. Work through it in order. The [hPanel tour](https://www.savemores.store/guides/hpanel-tour) shows where the security and backup tools live. 1. Change every password: hosting account, site admin users, database and FTP. 2. Run the malware scanner in hPanel's security section, and contact Hostinger support with what you found. 3. Restore a clean backup from before the infection, if you have one. 4. Update WordPress, every plugin and theme, and remove anything you don't use. 5. If Google flagged the site, request a review in Search Console once it's clean. ## Security and speed are linked A hacked site is often a slow one, and a site stuffed with plugins is both slower and easier to break into. If your site feels sluggish, [this diagnosis checklist](https://www.savemores.store/guides/speed-up-slow-hostinger-site) helps, and if you've genuinely outgrown shared hosting, [here's how to tell](https://www.savemores.store/guides/when-to-upgrade-shared-hosting). SaveMores is an independent Hostinger referral site. If you buy through a link here we may earn a commission, at no extra cost to you. That's why a coupon button appears on this page, and it's why I also say where Hostinger is the wrong choice. The [disclosure page](https://www.savemores.store/disclosure) and [how we test](https://www.savemores.store/how-we-test) explain the rest. ## FAQ ### Is SSL enough to make my website secure? No. SSL encrypts the connection between visitors and your site, but it doesn't protect weak passwords, outdated plugins or missing backups. It's the first step, not the whole job. ### Do I need a security plugin for WordPress? It helps, mainly for login protection and alerts, but it doesn't replace updates, strong passwords and backups. One well-maintained security plugin is enough; several overlapping ones slow the site down. ### How often should I back up my website? Weekly is enough for a site that rarely changes. A store or a site updated daily should have daily backups, plus a copy stored away from the server. ### Does Hostinger protect my website from hackers? Hostinger secures the servers and network and includes SSL, backups and malware scanning tools. Keeping your site software updated and your logins safe is still your responsibility. ### What's the most common way small websites get hacked? Reused or weak passwords and outdated plugins or themes with known holes. Unique passwords, two-factor login and regular updates block most attacks.