Passwords and logins
Use a unique, long password for every account that touches your site: hosting, domain registrar, website admin, email and any builder. A password manager makes this realistic. Turn on two-step verification wherever it is offered, particularly for hosting and the registrar.
Avoid the username admin on WordPress. If you have it, create a new administrator with a different name and delete the old one.
Keep software current
Out-of-date themes, plugins and core software are the most common way sites are compromised. Turn on automatic updates for security releases where your platform supports it, and schedule a regular review for everything else. Remove software you do not use rather than leaving it deactivated, since deactivated code can still hold flaws.
Control who has access
List everyone with a login. Give each person the lowest level of access needed: a person who only writes blog posts does not need administrator rights. Remove accounts for former staff and freelancers on the day they leave. Use named accounts rather than a shared login so you can see who changed what.
Protect forms, uploads and the login page
Forms that accept file uploads can be abused, so restrict allowed file types and sizes. Add spam protection and limit login attempts, so automated guessing gets blocked. Consider renaming or protecting the default admin login address, or requiring a code in addition to the password.
Keep the site on https and make sure your hosting plan includes basic firewall protections.
Back up, scan and have a plan
Security is never perfect, so recovery matters. Keep automatic off-site backups and test a restore. Use a scanning service or plugin that alerts you to changed files or known malware. Write a one-page plan: who to call, where backups are, and how to reset passwords.
Be wary of pirated themes and plugins, which often arrive with hidden code. Buy or download software from official sources only.
If you want a second pair of eyes on your setup, a website care provider such as MCC Solutions can review these items with you.
A one-hour starter plan
In your first hour, do four things. Put every login into a password manager and replace weak or repeated passwords. Turn on two-step verification for hosting and the registrar. Delete one unused plugin or user. Confirm a recent backup exists and note where it is stored.
These steps cost nothing and block the attacks seen most often. After that, add a monthly reminder to check updates and review user accounts.
Keep your recovery details current too. Two-step verification is only helpful if you can still get in when a phone is lost, so store backup codes somewhere safe and offline, and make sure the recovery email for each account is one you still read.
Finally, keep the contact details for your host's security team handy. Knowing whom to call within minutes of noticing a problem is more valuable than any plugin, and it keeps a small incident from growing.
Common questions
Is a security plugin enough?
It helps, but it does not replace updates, strong passwords, backups and limited access.
Do small sites really get attacked?
Automated scans hit sites of all sizes. Size matters less than whether the common gaps are open.
How often should I review security?
A short check each month and a full review a couple of times a year works for many small sites.
This guide is general information. Search engines change how they work and their guidelines; check Google's current documentation for your situation. Nobody can guarantee a ranking.