Security questions

Keep everything updated, use long unique passwords, turn on HTTPS and take backups you control. Those four cover the overwhelming majority of real attacks on small sites — outdated plugins are the single most common way a site gets compromised.

Change every password first, then take a copy of the site as evidence before cleaning anything. Find and remove the malicious files, update everything, and only then bring the site back. Restoring a backup without closing the original hole just gets you reinfected.

That is a common symptom of a compromise: injected code in .htaccess, a theme file or the database sends visitors elsewhere, often only on mobile or only for first-time visitors. Treat it as a hacked site and clean it properly.

Length, and never reusing it. A passphrase of four or five unrelated words beats a short password full of symbols, and a password manager means you never have to remember any of them.

You cannot stop the attempts — every site on the internet gets them — but you can make them pointless. A long unique admin password, a plugin that limits login attempts, and not using admin as a username together handle it.

The usual signs are bounce messages for mail you never sent, contacts receiving spam from your address, or sent items you do not recognise. Change the mailbox password immediately, then check for forwarding rules an attacker may have added.

Treat it as phishing until you have checked independently. Never click the links: log in to the client area directly by typing the address yourself, and see whether anything is actually wrong there.

Sort the File Manager by modification date: injected files almost always have a timestamp that does not match your last real change. Look especially for PHP files in upload folders, where no PHP file should ever be.

They are instructions your site sends with each page telling the browser how to behave — for example, to refuse to load the page inside someone else’s frame. You add them in .htaccess, and a sensible basic set takes a few minutes.

Malware on a website is code an attacker has added to your files or database — to send spam, redirect your visitors, or serve their content from your domain. It usually arrives through an outdated plugin or a stolen password rather than through the server.

Phishing is a message designed to look like it comes from a service you use, to get you to enter your password on a fake page. Hosting and domain accounts are common targets because they control everything else.

A DDoS attack floods a site with traffic from many machines at once so real visitors cannot get through. It is a availability attack, not a break-in — nothing is stolen, the site simply stops responding.

SQL injection is when input from a visitor is passed into a database query without being handled safely, letting an attacker change what the query does. It is one of the oldest web vulnerabilities and still one of the most damaging.