Website Hardening

Hardening goes beyond installing a security plugin. It means shrinking the attack surface and making it harder for an attacker to misuse the website. Typical steps include applying updates, limiting administrative privileges, protecting authentication, removing unused software, reviewing file permissions, configuring HTTPS and maintaining monitored, recoverable backups.

The right controls depend on the platform and its threat model. For a managed website builder, much of the server-level work belongs to the provider. For a self-hosted application, the operator may also control network access, deployment credentials and runtime settings. Security changes should be tested because restrictive configuration can break legitimate integrations or block customers.

Hardening is a continuous process, not an audit certificate or promise that a website cannot be hacked. It differs from an incident response plan, which governs what to do after a suspected compromise. A practical small-business checklist includes a record of owners, update windows, recovery tests and third-party access reviews.