Web security can be intimidating, but the essentials come down to a few habits that are far more effective than any gadget. Here are the basics, in order of importance.

1. HTTPS: the bare minimum

HTTPS (the padlock in the browser) encrypts the exchanges between the visitor and the site. Without it, everything travels in plain text. It is now free (Let’s Encrypt) and expected by everyone — Google even downranks sites without HTTPS. It’s non-negotiable.

2. Strong passwords + two-factor authentication

• Strong password: long, unique, unpredictable. Use a password manager instead of reusing the same one everywhere.
• Two-factor authentication (2FA): a second proof (a code via app or SMS). Even if it’s stolen, the password is no longer enough. It’s the best protection for your accounts (site admin, host, email).

3. Updates: flaw number one

A hacked site almost always gets hacked through software that wasn’t updated: an old CMS, an abandoned extension. Updates fix known flaws. Put them off, and you leave the door open.

Rule: fewer extensions = a smaller attack surface. Install only what you use, and uninstall the rest.

4. Backups: the safety net

A recent backup, kept separately (not only on the server), lets you restore everything after a failure, a slip-up or a hack. It’s your insurance. Also check that it actually restores.

Common attacks (in plain terms)

• Phishing: a fake message imitates a brand to steal your credentials. Check the sender and the address before clicking.
• Brute force: a bot tries thousands of passwords. Defence: strong passwords + limiting login attempts.
• Injection: malicious code is slipped in through a poorly protected form. Defence: up-to-date software, well-designed forms.
• Malware: a booby-trapped file uploaded to the server. Defence: limited permissions, monitoring.

The minimal checklist

1. HTTPS enabled everywhere. ✅
2. Strong passwords + 2FA on all access points. ✅
3. Regular updates (CMS, extensions). ✅
4. Automatic backups, kept separately and tested. ✅
5. As few extensions as possible. ✅

Security isn’t a product you buy, it’s a discipline you maintain. These five points rule out the vast majority of problems.