How to Secure a New Website (Beginner Guide)

Security is one of those things that feels optional until something goes wrong. Most people launching a new site are focused on design, content, and getting pages live — which is fine. But once a site is on a public domain, it starts receiving automated traffic from bots scanning for exploitable weaknesses.

These bots aren’t targeting you specifically. They run continuously across millions of sites, looking for outdated plugins, default usernames, exposed login pages, and missing HTTPS. Basic security steps block the majority of these attacks before they have any chance of succeeding.

In most sites I build, I run through a short security checklist shortly after launch. It doesn’t take long, and the steps below cover the areas that matter most for a new or growing site.

Quick Answer

To secure a new website, keep your platform, themes, and plugins or extensions updated, use a strong unique password and a non-default admin username, add security monitoring appropriate to your platform, enable SSL, limit login attempts, and set up regular backups. These steps cover the most common attack vectors for beginner and intermediate sites.

Why Websites Get Targeted

Popular platforms like WordPress run a large portion of the web, which makes them a consistent target. Attackers exploit volume rather than choosing targets individually — they run automated scans looking for sites running outdated software, predictable login paths, or common admin usernames.

A hacked site can result in malware being injected into your pages, your site being used to send spam, your content being altered, or your site being taken offline. Recovery takes significantly longer than prevention. The steps below address the most frequently exploited weaknesses.

How to Secure Your Website

Step 1: Keep Everything Updated

Your platform, themes, and plugins or extensions all release security patches as vulnerabilities are discovered. If you’re running outdated versions, those vulnerabilities are public knowledge — bots scan for them actively.

Check your platform’s update or dashboard area regularly and apply any pending updates. On WordPress, this is under Dashboard → Updates, with an auto-update toggle for individual plugins under Plugins → Installed Plugins; other platforms usually offer something equivalent, or update automatically without you needing to check at all.

Remove plugins and themes you aren’t using. Inactive plugins can still be exploited if they contain vulnerabilities, and they clutter your updates list.

Step 2: Use a Strong Password and a Non-Default Username

Brute force attacks cycle through common usernames like admin, administrator, and user combined with common passwords. If your admin account uses any of these usernames, change it.

To change your username, the easiest method is to create a new administrator account with a different username, log in as that new account, and delete the original. On WordPress, this means Users → Add New, setting the role to Administrator, then logging in with the new account and removing the old one — other platforms vary, but the create-new/delete-old approach works broadly the same way.

For the password, use a randomly generated string of at least 16 characters. Most platforms, including WordPress, will suggest a strong password when you edit your user profile — accept it and save it in a password manager.

Step 3: Enable Two-Factor Authentication

Even a strong password can be compromised if it appears in a data breach. Two-factor authentication adds a second verification step — typically a time-based code from an app on your phone — so that stolen credentials alone aren’t enough to gain access.

For a step-by-step setup, see the guide on how to add two-factor authentication to WordPress. It covers plugin options and configuration for both administrator and contributor accounts.

Step 4: Limit Login Attempts

By default, most platforms allow unlimited login attempts. This makes brute force attacks straightforward — a bot can try thousands of username and password combinations without being blocked.

Add a tool that limits failed login attempts — on WordPress, a free plugin like Limit Login Attempts Reloaded is a common choice, installed then configured under Settings → Limit Login Attempts; many hosted platforms build this in natively. After a set number of failed attempts, the IP is locked out for a configurable period — the defaults are reasonable for most sites.

Step 5: Install a Security Plugin

A dedicated security tool adds firewall rules, malware scanning, and activity logging. On WordPress, Wordfence Security and Sucuri Security (both with free tiers) are widely used plugins; many hosted platforms and managed hosts build equivalent protection in at the infrastructure level instead.

Wordfence, as an example, includes a web application firewall that blocks malicious requests before they reach your site, and a scanner that checks your files against known clean versions of WordPress core. The free version covers the essentials for most small to medium sites.

After installing, run an initial scan and review any warnings. Common findings include plugin versions with known vulnerabilities or files that have been modified unexpectedly.

Step 6: Enable SSL and Force HTTPS

SSL encrypts data sent between your server and visitors. Most hosting providers now include free SSL certificates via Let’s Encrypt, and many activate it by default. If your site is still on HTTP, enable SSL through your hosting control panel.

Once SSL is active, make sure your platform’s own site-URL setting also uses https:// — on WordPress this means updating both the WordPress Address and Site Address fields under Settings → General. Then add a redirect rule (via .htaccess, your hosting panel, or your platform’s own redirect settings) to redirect all HTTP traffic to HTTPS automatically.

Step 7: Set Up Regular Backups

Backups are not a preventive measure — they’re a recovery measure. If your site is compromised or something breaks, having a recent backup is what allows you to restore quickly rather than rebuilding from scratch.

Use a backup tool — on WordPress, a plugin like UpdraftPlus is a common choice — to schedule automatic backups and send them to an external location: Google Drive, Dropbox, or Amazon S3. Store backups off-server so a compromise of your hosting account doesn’t affect your backup copies.

Practical Tips

I usually set core software to auto-update minor versions, manually review plugin or extension updates weekly, and keep automatic backups running daily. That combination handles most risk with minimal ongoing effort.

Check your hosting panel for any built-in security tools — many managed hosts include malware scanning, firewalls, and automatic plugin update management at the server level, which can complement or replace plugin-level security.

If you’re on shared hosting and someone else on the same server gets hacked, there’s a risk of cross-contamination. Moving to a managed WordPress host or a VPS with isolation reduces this. It’s not urgent for a new site, but worth factoring in as you grow.

If you’re on WordPress specifically, the WordPress hardening documentation covers advanced topics like file permissions, database user privileges, and disabling the file editor — useful reading once the basics above are in place.

Common Mistakes

Using “admin” as the username. It’s the first username every brute force tool tries. Change it before your site receives any real traffic.

Leaving unused plugins installed. Even deactivated plugins can be scanned for vulnerabilities. Delete anything you’re not actively using.

Assuming the hosting provider handles everything. Hosts secure the server infrastructure. The application layer — plugins, themes, user accounts — is your responsibility.

Skipping backups until something breaks. A backup that doesn’t exist yet can’t help you. Set up automated backups before you need them.

When to Use a Security Tool vs Managed Hosting

On shared hosting, a security plugin or app — like Wordfence on WordPress — covers most situations at no extra cost. On managed hosting (Kinsta, WP Engine, and Cloudways are common examples for WordPress specifically), the host often handles malware scanning, firewall rules, and automatic updates at the infrastructure level — in that case, a lightweight security tool or just the built-in protections is usually sufficient.

If you’re running a site with user accounts, e-commerce, or sensitive form data, consider adding a Web Application Firewall (WAF) through a service like Cloudflare. The free tier provides basic DDoS protection and bot filtering that sits in front of your hosting entirely.

If you’re on WordPress, one more attack surface worth closing is XML-RPC — a legacy remote access endpoint that stays active by default. Most sites don’t need it, but bots scan for it constantly and use it to run brute-force attacks that can bypass standard login limiting. Disabling XML-RPC takes a few minutes and is worth adding to your initial hardening checklist.

If you want to take things further, follow the step-by-step guide on how to harden WordPress security after installation — it covers the specific settings that reduce your attack surface before the site goes live.

If you want to restrict access to specific pages — client previews, internal resources, or gated content — WordPress also lets you password protect individual pages and posts without a plugin. It takes under a minute and requires no extra software.

Conclusion

Running through these steps after launch takes less than an hour and covers the majority of common attack vectors. The first step on that list is getting HTTPS active — see the guide on how to set up SSL and HTTPS in WordPress if you haven’t done that yet. Keep software updated, use strong credentials, enable 2FA, and make sure backups are running. Once those foundations are in place, consider adding HTTP security headers to close a further set of browser-level vulnerabilities that most sites leave open by default. Once your initial hardening is done, run a periodic security audit to catch the gaps that accumulate over time — outdated plugins, forgotten user accounts, and configuration drift that initial setup doesn’t anticipate.