How to Secure a Business Website

Encrypt everything with HTTPS

Install a certificate with automatic renewal, redirect all HTTP traffic to HTTPS, and fix mixed content. Then consider HSTS so browsers never try plain HTTP.

Patch the platform

Outdated CMS software and plugins are a leading cause of website compromise. Turn on automatic updates where safe, remove unused plugins and themes, and subscribe to your platform’s security announcements.

Add security headers

Headers such as Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options and Referrer-Policy switch on browser defences. See our security headers guide for values.

Protect login and admin areas

• MFA for every admin account.
• Unique, long passwords from a password manager.
• Limit login attempts and remove default admin usernames.
• Give each person the minimum role they need.

Set cookies safely

Session cookies should have Secure, HttpOnly and SameSite attributes so they are not sent over plain HTTP or readable by scripts.

Reveal less

Hide version numbers in Server and X-Powered-By headers and generator tags. This does not fix vulnerabilities, but it stops announcing which known flaws might apply.

Monitor

Certificates expire, settings regress and records change. Scheduled checks catch these early. PixelPrivate monitoring re-runs checks and alerts you to changes.