NTG STUDIO WEBShort answer
To prevent a WordPress or PHP site from being hacked, keep the core, plugins, themes and PHP version up to date, remove anything unused, back up daily off the server, protect administrator access, install a web application firewall, monitor the site continuously and prepare an incident response plan.
Key takeaways
- Most hacks exploit components that weren’t updated
- An unsupported PHP version is a risk on its own
- A backup only exists if it’s tested and stored elsewhere
- Monitoring detects the attack before your customers do
A hacked business website redirects visitors to scams, sends spam from your domain or disappears from Google. Most of these incidents exploit known flaws in components that weren’t updated. Regular maintenance is the best protection.
1. Update, always
The CMS core, plugins, themes and libraries regularly receive security fixes. Apply them quickly, after a backup and a test on a copy of the site where possible.
2. Watch the PHP version
Each PHP version is supported only for a limited time. After that, it no longer receives security fixes. Check the version your hosting uses and plan a migration to a supported one. It’s often the most neglected task.
3. Remove what you don’t need
Deactivated plugins, unused themes, former contractors’ accounts, test files. Every unnecessary item is a potential door.
4. Protect administrator access
Strong, unique passwords, two-factor authentication, limited login attempts, named accounts with only the rights they need.
5. Back up for real
Daily backups of files and database, stored off the server, kept for several weeks and tested regularly with a restore. An untested backup is just a hope.
6. Install a web application firewall
It blocks common attacks before they reach the site: injections, brute force, malicious bots.
7. HTTPS and security headers
A valid SSL certificate, systematic redirection to HTTPS and security headers configured on the server.
8. Monitor continuously
Uptime, file changes, Google blacklist status, certificate. An immediate alert lets you act before visitors or Google notice.
9. Prepare the response
Who to notify, how to isolate the site, restore, change credentials and request removal of Google warnings. A written plan saves precious hours.
What our maintenance includes
Updates, tested daily backups, monitoring, firewall, PHP patches, a monthly report and intervention when incidents happen. Details on Maintenance & webmaster and Security & hosting.
For a startup’s product site, read Startups and software companies: the product site that gets people to try. Our offer is on Telecom & tech.
Frequently asked questions
How do I know if my site has been hacked?
Common signs: redirects to other sites, unknown pages in Google, browser warnings, sudden slowness, spam emails sent from your domain. An audit confirms it.
Are small sites really targeted?
Yes. Attacks are largely automated and target every known flaw, whatever the site’s size.
Is maintenance expensive?
Our maintenance starts at 35,000 FCFA a month, with updates, backups, monitoring and patches. Repairing a hacked site usually costs far more.
Founder of NTG Studio Web in Douala. Master’s in international public law, IBM Data Analytics and Anthropic AI Fluency certified. He designs websites and visibility strategies for African businesses. Learn more →