If you only have ten minutes, this is the security checklist I would start with first: update WordPress, turn on two-factor login, confirm your backups, and remove anything you do not actually use.
When I look at small business and charity websites, the same questions come up again and again: How do I keep WordPress safe? What matters most if I am short on time? Do I need a pile of tools, or just a few habits done well? As the U.S. Small Business Administration notes, basic cyber hygiene still does most of the heavy lifting for small organisations. And the UK National Cyber Security Centre’s charity guide makes the same plain-language point for nonprofits: the fundamentals are what protect you first.
That is the good news. You do not need to become a security specialist to improve your site. You need a quick map of the biggest risks, the highest-impact fixes, and the recovery steps that keep a bad day from turning into a bad month. In this guide, I will walk through the plain version of website security for 2026: updates, passwords, two-factor authentication, hosting checks, backups, basic WordPress hardening, and a simple checklist you can use today.
Why website security matters more in 2026
Small organisations are not too small to be noticed. They are often attractive because they have valuable data, modest technical resources, and busy people wearing three hats at once. That mix is common in small businesses, artist-run sites, and charities, which is exactly why good security is less about drama and more about routine. If your website takes enquiries, accepts payments, stores donor details, or sends password-reset emails, it is part of your operating life, not just your online brochure.
The plain truth is that most security trouble starts with something ordinary: an outdated plugin, a reused password, a forgotten admin account, or a backup that was never tested. WordPress’s own security guidance leans heavily on maintenance for a reason. Secure websites are usually not “lucky”; they are updated, trimmed down, and checked regularly.
Quick definitions: the terms that matter
- WordPress core: the main WordPress software that powers your site.
- Plugin: an add-on that gives your site extra features such as forms, backups, or security controls.
- Theme: the design layer that controls how your site looks and some of how it behaves.
- Two-factor authentication (2FA): a second login step, usually a code from an app or text message, in addition to your password.
- HTTPS: the secure version of your website address, shown by the padlock in most browsers.
- PHP/MySQL: the server software that runs WordPress behind the scenes; it needs to be current enough to stay supported and secure.
The highest-impact basics: updates, passwords, and 2FA
If I had to rank the basics by impact, I would start here. These are the habits that stop a lot of avoidable trouble before it starts. They are also the easiest place for a small team to gain ground quickly.
1. Update WordPress core, plugins, and themes
Updates are not just about new features. They often include security fixes and compatibility repairs. If your site uses a theme or plugin that has not been maintained in a long time, that is a useful warning sign all by itself. A safe rule of thumb: if you no longer need it, remove it; if you do need it, keep it current.
- Check for available updates at least once a week.
- Update core, then plugins, then the theme.
- Keep a backup before major updates.
- Remove inactive plugins and unused themes instead of leaving them parked “just in case.”
2. Use strong, unique passwords
A strong password is not a fancy password; it is a long, unique one that no one has used anywhere else. That part matters because password reuse is where one leaked login can snowball into a bigger problem. A password manager makes this much easier, because the human brain is excellent at forgetting twelve random characters and equally excellent at pretending it will remember them later.
WordPress documents its password best practices plainly: use unique passwords, store them safely, and do not rely on something simple you have used everywhere since 2019.
3. Turn on two-factor authentication
2FA gives you a second barrier even if someone learns your password. For most small teams, that is one of the best security upgrades you can make in an afternoon. Use it for every admin account, and ideally for any account that can edit content, manage users, or change site settings.
Example: if your charity’s volunteer coordinator logs in only once a month, 2FA adds a small extra step, but it also means a stolen password is much less useful to anyone else. That is the kind of trade-off worth making.
Hosting and platform checks that matter
Security is not only about what happens inside WordPress. Your host and server settings matter too. A decent host should support HTTPS, use current server software, and give you access to backups, updates, and logs without making you chase them through six menus and a support ticket.
HTTPS should be the default
If your site still loads without HTTPS, fix that first. HTTPS protects data in transit and helps visitors trust the site they are using. It is especially important for contact forms, login screens, donation flows, and any page where people share personal details.
WordPress’s requirements page is a good reminder that modern hosting should not feel like a museum piece. If your environment is hanging onto unsupported versions of PHP or database software, that is a maintenance job, not a minor preference.
Use only trusted, actively maintained plugins and themes
A plugin can be helpful, but every extra plugin also adds another place to maintain. I like a simple question: “Do we actually need this?” If the answer is fuzzy, the plugin probably does not deserve a permanent place on the site. Choose tools that are actively maintained, widely used, and updated regularly by their developers.
- Check the last update date before installing anything new.
- Read recent reviews and support activity.
- Avoid abandoned tools that still “seem to work.”
- Keep the plugin list short enough that you can actually review it.
Backups, recovery, and the calm response plan
Backups are one of those things everyone says they have until the day they need them. A backup only counts if it is recent, stored somewhere safe, and actually restorable. That means you should know not just where the backup lives, but whether you could use it in a hurry.
For a small site, a practical setup is simple: keep one automatic backup copy off the server, keep another copy in a separate account or storage location, and test a restore occasionally. If you are using a managed host, confirm exactly what they back up, how long they keep it, and how to restore it before you ever need the answer.
- Daily backups for active sites with forms, sales, or frequent updates.
- Weekly backups may be enough for quieter brochure sites.
- Keep backups outside the main hosting account.
- Test a restore on a staging site or safe test environment.
If something does go wrong, the immediate goal is not panic; it is containment. Change passwords, review user accounts, check recent changes, restore from a clean backup if needed, and contact your host. If the issue affects user data, donor data, or payment information, you may also need to review your notification and compliance obligations. A careful response is usually better than a loud one.
Simple hardening steps without getting technical
This is the part where people often expect a wall of jargon. It does not need to be that way. A few simple settings can reduce risk without making the site hard to run.
Trim access and remove what you do not use
- Delete old user accounts, especially when volunteers or contractors leave.
- Give each person the lowest level of access they need.
- Remove test pages, abandoned plugins, and unused themes.
- Review admin users regularly, not just at launch.
Limit login attempts and watch for strange activity
Login limiting does not make a site invincible, but it does make automated guessing less useful. Activity logging is similar: it helps you notice when something changes that should not have changed. For small teams, that kind of visibility is worth a lot. You do not need to stare at logs all day; you just need to know they exist and where to look.
Use a security plugin carefully, not blindly
A security plugin can be helpful for login protection, malware scanning, and alerts, but the plugin itself is not the strategy. The strategy is still updates, strong login habits, sensible hosting, and backups. Think of the plugin as a seatbelt, not a substitute for road sense.
For most sites, the best setup is the simplest one that covers the essentials and does not create maintenance headaches. If a tool asks for more configuration than your team can realistically manage, that is not a win.
A short security checklist you can act on today
| Check | What “done” looks like | How often |
|---|---|---|
| Updates | Core, plugins, and theme are current | Weekly |
| Passwords | Every account has a unique password | Ongoing |
| 2FA | Admin and editor accounts use two-factor login | Once, then review |
| HTTPS | Site loads securely with a valid certificate | Always |
| Backups | Recent backup exists off-site and can be restored | Daily or weekly |
| Users | No old or unnecessary accounts remain | Monthly |
| Plugins | Only maintained tools stay installed | Monthly |
If you want the shortest possible version, here it is: update, protect logins, verify backups, and keep the site lean. That four-step habit solves a surprising amount of the everyday risk that small websites face.
When to ask for professional help
There is no prize for doing everything alone. If your site handles payments, manages memberships, collects donor details, or supports a busy team with frequent content updates, professional help can save time and reduce avoidable mistakes. The same is true if you are unsure whether the site has reliable backups, whether your host is current, or whether old accounts and plugins have been cleaned up properly.
If you need a second set of eyes, start with a simple question rather than a big project: what is the one security gap that would matter most if it were missed? That question usually reveals the next step faster than a long checklist ever will. For broader website support, you can also review the Support page, read more on the blog, or visit the website design page to see how secure setup and clean design can work together.
For ongoing visibility and search-friendly maintenance, it can also help to align security work with your broader site care. That is where a page like SEO can be useful too, because good technical upkeep and clean site structure usually travel together.
Conclusion: start small, stay consistent
Website security in 2026 does not need to be mysterious. The sites that hold up best are usually the ones with boringly good habits: they update on time, they use strong login protection, they keep clean backups, and they remove what they no longer need. That is not glamorous, but it is effective.
If you run a small business, artist portfolio, or charity website, the next best move is simple: choose one area from the checklist and fix it today. Then come back for the next item. Security works better as a routine than as a one-time panic sprint.
- Keep WordPress, plugins, and themes updated.
- Use strong, unique passwords and 2FA.
- Confirm HTTPS, supported hosting, and trusted software.
- Maintain backups you can actually restore.
- Remove unused accounts, plugins, and themes.
For more practical website guidance, start at the home page, or reach out through the contact page if you want help planning the next step.