Website security basics that stop 95% of incidents

Most hacked small sites are not targeted. Automated bots try known plugin holes, weak passwords and old software on everything. The defence is maintenance, not magic.

The four habits

• Updates — WordPress core, themes and plugins, promptly. Our safe-updates feature snapshots first and rolls back automatically if an update breaks things.
• Backups — daily, tested restores, plus your own copy before big changes.
• Passwords — unique, long, in a manager; two people sharing one admin login is how credentials leak.
• Least privilege — give accounts and plugins the minimum access they need. An editor login cannot install plugins; that is the point.

What we watch for you: known-vulnerable plugin versions (alerted, then updated via safe-updates on eligible plans), failed-login storms, and files changing when nobody is working.