Updated 18 September 2026. Originally published in 2018; revised to replace outdated advice and links.
Website security is ongoing work. A firewall, certificate or scanner can help, but no single tool guarantees protection. These five areas give a business owner a useful starting point for a conversation with their developer or host.
1. Account attacks and unwanted automated traffic
Use unique passwords, appropriate multi-factor authentication and access limited to the people who need it. Remove unused accounts. Rate limiting and bot controls can help reduce abuse, but test that genuine customers and search crawlers still work.
2. Traffic floods and outages
A distributed denial-of-service attack aims to exhaust resources and disrupt availability. Ask what protection your provider supplies, how you will be notified and who handles an incident. Ordinary application firewalls cannot solve every network-level flood.
3. Cross-site scripting
Unsafe handling of content can let an attacker run unwanted code in a visitor’s browser. Developers need to handle input and output correctly. For a business owner, a useful first step is keeping supported software updated and removing abandoned extensions.
4. Database injection
Vulnerable code may allow an attacker to change a database query. Secure development, maintained plugins and restricted database permissions reduce the risk. A firewall is an additional control, not a repair for unsafe code.
5. Malware and compromised connections
Use HTTPS to protect the browser-to-server connection, but remember that it does not remove malware from a website. Monitoring and scanning can help detect problems; recovery also needs clean backups and investigation of how the attacker gained access.
Have a recovery plan before you need one
Record who handles updates, where backups are stored, how restoration is tested and who to call. Use WordPress’s hardening guidance as a technical reference. If a site is compromised, preserve useful evidence and involve the people responsible for security and data protection.
Explore our hosting and support options or ask the team about your existing setup. The original 2018 traffic statistics and claims that individual tools could block every attack have been removed.
