●  02922 74258215 Neptune Court, Vanguard Way, Cardiff Bay, CF24 5PJ
Message us on Facebook

Domain services

Start with the right name.

Register a new domain or bring an existing domain to Web Hosting Cymru.

Website Security Guide

Keeping your website safe shouldn’t be complicated

This simple guide walks you through the key things every website owner should have in place - from updates and backups to monitoring and protection - so you can stay secure without the stress.

Why This Matters

Website problems often start with something small

A missed update, an outdated plugin or an account with weak security can go unnoticed for weeks. When something eventually goes wrong, the impact can reach beyond your website - affecting customer enquiries, sales and confidence in your business.

Small issues can cause real disruption

Imagine arriving at work to discover your website isn't loading. Customers can't reach your contact form, enquiries may be going unanswered and you don't know how long the problem has been there.

Sometimes an outage is caused by a failed update or a technical fault. In other cases, an outdated plugin or compromised account can be involved. Not every website problem is a security incident, but keeping on top of routine maintenance can reduce avoidable risks.

The good news is that protecting a business website doesn't have to be complicated. Regular checks, sensible account security and a reliable recovery plan make it easier to spot problems early and respond when something does go wrong.

Common things that get missed

  • WordPress core, themes or plugins left outdated
  • No recent, verified website backup available
  • Weak passwords or administrator accounts without multi-factor authentication
  • Former employees or developers still having website access
  • Security warnings or unusual activity going unnoticed
  • Assuming secure hosting automatically protects every part of a website
The 6 Essentials

Six essentials every website owner should understand

Protecting your website does not have to be complicated. These six areas cover the everyday basics that help reduce risk, protect customer trust and make problems easier to deal with if they arise.

01 / UPDATES

Updates

Outdated WordPress software, plugins and themes can leave known vulnerabilities open. Regular, carefully managed updates help reduce that risk.

  • Keep WordPress core, plugins and themes current
  • Remove unused or unsupported software
  • Check that your website still works after updates
02 / BACKUPS

Backups

If a website breaks or is compromised, a reliable backup can make recovery much easier. The important thing is knowing that your backups can actually be restored.

  • Check that backups run as expected
  • Keep suitable restore points, ideally separate from the website
  • Know how to test and restore a backup
03 / MONITORING

Monitoring & Protection

Problems are easier to manage when they are discovered early. Depending on the tools in place, monitoring can highlight downtime, suspicious activity or signs of malware.

  • Check for unexpected website changes
  • Use appropriate malware and uptime checks
  • Make sure alerts are reviewed and acted on
04 / ACCOUNT ACCESS

Passwords & Access

Even an updated website can be at risk if someone gains access to an administrator account. Strong sign-in protection and sensible user permissions are essential.

  • Use unique, strong passwords and MFA where available
  • Give users only the access they need
  • Remove accounts that are no longer required
05 / SECURE CONNECTIONS

SSL & HTTPS

HTTPS helps protect information travelling between a visitor and your website. It is an important baseline, but the padlock alone does not mean a website is free from vulnerabilities.

  • Check that your website uses HTTPS throughout
  • Keep SSL certificates valid and renewed
  • Remember that HTTPS does not replace website maintenance
06 / LAYERS OF SECURITY

Website & Hosting Protection

Secure hosting provides an important foundation, but website software and user accounts need protection too. A layered approach helps reduce the chances of one weakness becoming a bigger problem.

  • Use appropriate firewall and login protections
  • Keep website software and hosting accounts secure
  • Understand what your hosting plan does and does not cover
Your Security Checklist

How secure is your website?

You don't need to be a technical expert to ask the right questions. Work through these eight checks to see what you already have covered and where you might need a little more clarity.

What can you confidently tick off?

Tick each statement only if you know it's true. Leave anything you're unsure about unticked - that's simply something to investigate.

This quick checklist is a starting point, not a security audit. Your selections stay on this page and are not submitted or saved.

Free Printable Workbook

Take your website security check a step further

Download our Website Security & Maintenance Health Check workbook. It includes a more detailed assessment, backup guidance and space to record the actions you want to take. Print it, work through it at your own pace and keep it for your records.

Download the Free Workbook (PDF)
Two Layers of Protection

Secure hosting and a secure website are not the same thing

Your hosting provider looks after the environment your website runs on. Your website's software, accounts and day-to-day upkeep need attention too. Both matter when it comes to protecting your business online.

01 / Hosting infrastructure

What your hosting protects

Web Hosting Cymru manages the hosting environment and provides hosting backups as part of its services. These are important foundations for keeping websites available and recoverable.

  • Hosting server and infrastructure management
  • Security measures applied at the hosting level
  • Hosting backup arrangements, subject to your plan
  • Support with hosting-related issues
02 / Website application

What still needs maintaining

A website can develop problems even when its hosting environment is protected. WordPress, plugins, themes and user accounts need their own ongoing care.

  • Keeping website software updated and compatible
  • Reviewing administrator access and enabling MFA where available
  • Removing unused or unsupported software
  • Checking website health and responding to suspicious activity

A backup is not always a clean backup

Hosting backups capture a website at a point in time. If malicious code was already present, it may also be included in the backup. Restoring that copy could bring the problem back. Regular maintenance, appropriate monitoring and multiple recovery points help reduce this risk.

Hosting backups help with recovery. Website maintenance helps reduce avoidable problems. Independent off-site copies provide another recovery option.

Want to check your own arrangements? Our free Website Security & Maintenance Health Check includes practical questions about updates, backups, account access and recovery planning.

Download the Free Workbook (PDF)

When Security Is Overlooked

Small website problems can have a real business impact

Imagine arriving at work to find your website unavailable, your contact form failing or your online shop unable to take orders. Not every technical problem is a security incident, but neglected maintenance and weak security can make disruption harder to prevent, detect and recover from.

01 / ENQUIRIES

Missed customer enquiries

A broken contact form may go unnoticed for days. Your website looks normal, but potential customers cannot reach you and valuable enquiries may never arrive.

02 / SALES

Interrupted online orders

If an online shop stops working, customers may be unable to complete purchases. Even a short disruption can mean missed orders and extra work resolving the issue.

03 / COMPROMISE

Malware that goes unnoticed

An outdated plugin or compromised login can provide an opportunity for attackers. Unwanted redirects, spam pages or malicious code may remain hidden until someone spots a problem.

04 / RECOVERY

Backups that cannot solve everything

Hosting backups are valuable, but a backup made after an infection may contain the same malicious code. Recovery can require investigation and clean-up, not just restoring a file.

05 / CONFIDENCE

Loss of customer confidence

Security warnings, unexpected redirects or repeated errors can make visitors hesitate to contact you or place an order, even after the immediate issue has been resolved.

06 / RESPONSE

More disruption without a plan

When nobody knows who maintains the website, where independent backups are stored or whom to contact, a manageable issue can take much longer to resolve.

The aim isn't to cause concern. It's to help you recognise where straightforward precautions, regular updates, access reviews, monitoring, tested backups and a recovery plan can reduce risk and make problems easier to manage.

Warning Signs & First Steps

Know when your website needs attention

A website problem is not always a security breach. But unexpected changes, warnings or unusual activity should be investigated promptly. Recognising the signs early can limit disruption and make recovery easier.

What to do when something looks wrong

You do not need to diagnose the problem yourself. Start by recording what has happened, avoid making unnecessary changes, and involve the right person as soon as possible.

  1. 01
    Identify the problem. Is the website offline, displaying an error, redirecting unexpectedly, showing unfamiliar content or failing to process enquiries?
  2. 02
    Record what you can see. Note when the problem began, which pages are affected and any error messages. Screenshots can help a developer or support team investigate.
  3. 03
    Limit further risk. If you suspect an account has been compromised, contact your website administrator or hosting support promptly. Change affected credentials from a trusted device and enable multi-factor authentication where available.
  4. 04
    Preserve recovery options. Avoid deleting files, making multiple updates or immediately restoring a backup without checking the cause. An older backup may also contain the same infection.
  5. 05
    Get the right help. Contact the person responsible for maintaining your website. If customer data may have been exposed, seek appropriate data-protection advice as well.

Signs worth investigating

These symptoms can have different causes, but none should be ignored.

  • Unexpected redirects, unfamiliar pages or spam content
  • Browser security warnings or malware alerts
  • New administrator accounts or unusual login notifications
  • Missing content, broken forms or unexpected website changes
  • Sudden downtime or a major slowdown without an obvious cause

What to avoid

Well-intentioned quick fixes can make an incident harder to investigate.

  • Ignoring warnings because the homepage still loads
  • Deleting suspicious files before seeking technical advice
  • Installing several security plugins in a rush
  • Restoring an unverified backup and assuming the issue is resolved
  • Continuing to use an account you believe has been compromised

Looking After Your Website

Manage it yourself, or have someone look after it for you

Every business website needs attention over time. Some owners prefer to handle updates, checks and recovery planning themselves. Others would rather have professional help so they can focus on running their business.

Managing It Yourself

Stay in control of the routine

Looking after your own website can work well if you have the time, confidence and a clear process for keeping it maintained.

  • UpdatesCheck software updates and confirm your website still works afterwards.
  • BackupsUnderstand your hosting backups and keep an additional secure off-site copy where appropriate.
  • SecurityReview administrator access, security alerts and unusual activity.
  • Website checksTest important pages, forms and ordering processes regularly.
  • RecoveryKnow who to contact and what to do if your website is compromised or stops working.
Professional Website Care

Get help with ongoing maintenance

A maintenance plan gives you an agreed level of professional assistance with the routine work and oversight your website needs.

  • Planned maintenanceUpdates and maintenance tasks handled in line with your chosen plan.
  • Backup awarenessSupport with understanding recovery arrangements and identifying potential gaps.
  • Security oversightChecks and recommendations appropriate to the services included in your plan.
  • Website healthAttention to potential issues before they become bigger problems, where covered.
  • Professional supportKnow where to turn when you need advice or assistance.
Your Next Step

A little attention now can make a big difference later

Website security isn't a one-off task. Regular checks, sensible maintenance and a clear recovery plan can help you spot problems earlier and keep your business moving.

Review your website at your own pace

Our free Website Security & Maintenance Health Check gives you practical questions, backup guidance and space to plan what needs attention. Print it, work through it and keep it for your next review.

Download the Free Workbook (PDF)

Free to download. No registration required.

Need a hand with your website?

If you're unsure about updates, access, backups or maintenance, we're happy to talk through your concerns and help you understand the next steps. You can also ask about our ongoing website care options.

Practical advice about your website.

Need a Hand?

You don't have to manage your website security alone

Keeping your website secure is an ongoing job, but it doesn't have to become another task on your list. Whether you're reviewing your setup for the first time or need help with an existing issue, we're here to offer practical guidance.

Our hosting backups provide an important recovery safeguard. Ongoing website maintenance helps address the software, access and security issues that backups alone cannot prevent.

01 / REVIEW

Understand what protection your website already has

02 / MAINTENANCE

Keep website software and access under review

03 / RECOVERY

Get guidance on backups, malware and recovery options

04 / ONGOING CARE

Explore professional website maintenance and support

Not sure what your website needs? Start with a conversation. We'll help you understand your options, without pressure.