Website security: 8 habits that prevent most problems

A hacked website almost never looks the way people imagine. There is no black screen and no ransom note: most of the time the site keeps working normally while invisible content is injected into your pages, your visitors are redirected to dubious sites, or your server sends fraudulent emails in your name.

The damage shows up elsewhere: your search rankings collapse, your domain lands on a blocklist, and your emails stop reaching your clients. Here are the eight habits that prevent the vast majority of these situations.

1. HTTPS everywhere, no exceptions

The small padlock in the address bar is no longer optional. Without it, browsers display a "Not secure" warning that drives visitors away, and Google penalises the page.

In practice, an SSL certificate encrypts the exchange between the browser and your server. It is essential as soon as there is a form on the site — so, almost always.

Two details that are often overlooked:

• The certificate must renew automatically. An expired certificate makes the site unreachable, and it happens more often than you would think.
• Old http:// addresses must redirect to https://, otherwise Google sees two versions of the same site.

2. Regular updates, not once a year

This is by far the leading cause of hacked websites. Most attacks are not targeted: bots crawl the web testing known vulnerabilities on sites that have not been updated.

What needs to stay current:

• the CMS itself (WordPress, Drupal…);
• plugins and themes, including the ones you no longer use;
• the server-side language version (PHP in particular);
• the libraries the site relies on.

One important point: an unused plugin is still a way in. If you don't use it, uninstall it — don't just deactivate it.

The classic trap: updating without a backup, breaking the site, and having to start over. Hence the next point.

3. Backups you have already tested

A backup you have never restored is not a backup: it is an assumption.

What to check:

• Frequency should match your activity. A showcase site may be fine with weekly backups; a store taking orders every day needs daily ones.
• Location must be off the server. If your backup sits on the same machine as the site, a serious incident takes out both.
• Restoration should have been tested at least once. It is the only way to know how long a rollback actually takes.

The right question to ask: if the site disappeared tonight, how much work would I lose, and how long until it is back online?

4. Personal accounts, never shared

The single "admin" account with a password shared by five people is a classic — and a real risk.

Three simple rules:

• One account per person, with their name. When someone leaves or a contractor finishes, you remove their access without disrupting anyone else.
• The right permission level. Someone who writes articles does not need full administrator access. CMS platforms provide roles for this: use them.
• Two-factor authentication on administrator accounts. This is what stops an attack even when a password has leaked.

On passwords, the current recommendation is counter-intuitive: a long passphrase beats a short word stuffed with symbols. And a password manager is safer than a notebook or a shared file.

5. Protect forms against bots

As soon as a form is online, bots find it. Without protection you receive dozens of spam messages a day — and worse, you eventually stop reading your inbox, so you miss the genuine enquiries.

The modern solution is no longer the unreadable CAPTCHA with twisted letters. Invisible checks verify in the background that the request comes from a human, without asking anything of the visitor. That is what we put in place: the form stays simple for your clients, and spam is stopped before it reaches you.

Two complementary precautions: validate data on the server (never only in the browser) and rate-limit submissions from the same source.

6. Never store what you don't need to store

This is the most effective security principle there is: data you do not keep cannot leak.

Two concrete examples:

• Payments. No card number should pass through your server. A specialised provider handles it and you only receive a confirmation. That removes a considerable liability from your shoulders.
• Passwords. They must never be stored in plain text, and must not be "recoverable" — only resettable.

On compliance, Quebec's Law 25 and the European GDPR point the same way: collect only what is necessary, explain why, and set a retention period. That is not only a legal matter, it is also good security practice.

7. Monitor, so you don't find out too late

The worst scenario is not an outage: it is an outage nobody notices. A contact form broken for three weeks means three weeks of lost enquiries you never knew about.

What deserves automatic monitoring:

• site availability, with an alert when it goes down;
• the expiry date of the SSL certificate and the domain name;
• whether forms still work;
• server errors, which often flag a problem before it becomes visible.

A frequent and costly oversight: renewing the domain name. An expired domain means a site offline, email that stops working, and sometimes a domain bought by someone else.

8. Know who does what

This is the least technical point, and often the decisive one. Many sites deteriorate not through lack of skill, but because nobody was made responsible.

Questions worth settling in writing:

• Who applies updates, and how often?
• Who verifies that backups actually work?
• Who is contacted in case of an incident, and within what timeframe?
• Where are the credentials kept (domain, hosting, CMS)?

That last point deserves particular attention: your domain name and hosting accounts should be in your name, even if a provider manages them day to day. That is your guarantee of independence.

How we handle this

Security is not an option bolted on at the end. On the sites we build, HTTPS, form protection, data validation, security headers and Law 25 / GDPR compliance are part of the baseline work.

Going forward, we offer monthly maintenance plans that cover exactly points 2, 3 and 7: updates, verified backups, security monitoring and intervention when something goes wrong. You also get a client area to follow your projects and requests.

And if your site already exists and you are unsure of its condition, an audit gives you a clear picture with no commitment: CMS version, vulnerable plugins, backup status, HTTPS configuration.

In short

Website security rarely comes down to one spectacular measure. It comes down to eight regular habits: encrypt, update, back up, separate access, filter forms, limit what you store, monitor, and name someone responsible.

Unsure about the state of your site? Describe your situation in a few questions and we will get back to you within 48 business hours: start a project. For a simple question, our contact form is all you need.