Website security is a set of habits: strong, separate passwords, regular updates, backups, limited access and secure connections. The OWASP Top 10 (external site, opens in a new tab) lists the most critical web application risks, and the OWASP Cheat Sheet Series (external site, opens in a new tab) gives practical guidance. No site is perfectly safe, so plan for recovery as well as prevention.
Passwords
Strong and separate.
Updates
Software kept current.
Backups
Tested and stored away.
Recovery plan
Know what to do first.
The basics that matter most
- Strong, different passwords for your domain, hosting, website and email. A password manager helps.
- Two-step sign-in where it is offered.
- Updates. Keep the website software, themes and plug-ins up to date.
- Backups. Keep copies away from the website server, and test that they restore.
- Limited access. Give each person their own login and remove it when they leave.
- HTTPS. See what is HTTPS.
Protecting customer information
If your forms collect names, phone numbers or emails, collect only what you need, protect access and explain how you use it. See our privacy policy for how this website handles information.
What to do if something goes wrong
- Change passwords for the hosting, website and email accounts.
- Contact your host or developer.
- Restore from a clean backup if needed.
- Find out how it happened and close that gap.
Common mistakes
- One password everywhere. If one account leaks, all are exposed.
- Never updating. Old software is a common way in.
- No tested backup. A backup you cannot restore is not a backup.
- A developer holding the only login. See who owns your website.
- Believing HTTPS makes the site safe. It protects the connection only.
Key terms and where the definitions come from
Show key terms and sources
These explanations are ADA's own words, adapted from the independent sources named. Those organisations do not endorse or work with ADA, and the examples are illustrations, not real clients.
What is website security?
Website security means protecting a site, and the information visitors give it, from attack and misuse. The OWASP Top 10 is a widely used list of the most critical web application security risks to guard against.
Source: Based on OWASP, OWASP Top 10.
Reference: OWASP: OWASP Top 10 (external site, opens in a new tab)
For a Namibian business: A small business site with an out-of-date plugin and a shared password is an easy target. Regular updates and individual logins reduce the risk.
Related ADA service: Website care plans
What is HTTPS?
HTTPS is the secure version of the web's HTTP protocol. It encrypts what passes between a visitor's browser and your site and lets the browser check that it is really your site.
Source: Based on web.dev, Why HTTPS matters.
Reference: web.dev: Why HTTPS matters (external site, opens in a new tab)
For a Namibian business: A Namibian business whose contact form sends names and phone numbers should use HTTPS so that information is not readable by others on the same public Wi-Fi.
Related ADA service: Website care plans
Common questions
What is the most common way websites are hacked?
Weak or reused passwords and out-of-date software are widespread causes. Keeping both in order closes many of the common gaps.
Do small businesses get attacked?
Yes. Attacks are often automated and do not choose by size.
How often should I back up?
Often enough that losing the newest changes would not hurt. For a site that changes weekly, a weekly backup is a start. Ask what your host does already.
Is a free website safe?
It depends on the provider. Look at who keeps the software updated and who holds the backups.
What should I do if my site is hacked?
Change passwords, contact your host or developer and restore a clean copy. Then work out how it happened.
Need help with this?
Optional. You do not need any ADA service to use what you have just read.
- Website care plans
Updates, backups and security checks. - Locked out of your website
Getting back in and taking control.