A hacked site costs you both your customers' trust and your position in search engines. These simple rules remove most of the risk.
- Don't delay updates. Updates to WordPress and other content management systems, themes and plugins often close security holes.
- Delete plugins you don't use. A plugin that's switched off but not deleted can still be a way in for attackers.
- Strong, unique passwords. Use different passwords for the site admin panel, hosting, email and your iCode account. A password manager makes this easy.
- Two-step verification. Turn it on wherever you can, including in your iCode account.
- Limit access rights. Give each staff member their own account with only the rights they need. Close the accounts of people who leave straight away.
- Trusted sources only. Paid themes and plugins handed out "for free" often contain malicious code.
- Backups. To restore the site quickly if something goes wrong, follow the backup rules.
If you notice suspicious changes on your site (pages you don't recognise, redirects, ads), open a support request right away.