Building a secure website: the essential protections
A secure website combines, at minimum: HTTPS (SSL certificate) to encrypt exchanges, regular updates to the CMS and its extensions, recent and tested automatic backups, strong passwords with two-factor authentication for administration, and GDPR compliance on data collection. These baseline measures are generally included in quality hosting or a subscription, with no separate extra cost.
The real problem: security is only visible after the incident
Nobody notices a well-secured website: it just works. A hacked site, on the other hand, is noticed immediately, and often too late: homepage replaced, redirect to a suspicious site, contact form turned into a spam relay, or worse, a customer data leak. The cost of an incident (time to restore, reputation, possible obligation to report to the CNIL in case of a data leak) far exceeds the cost of prevention.
The classic trap: thinking "nobody's going to target my small site." The reality is that most attacks on small sites are automated, not targeted. Bots constantly scan the web looking for known flaws (an outdated plugin, a default password), regardless of the site's size or notoriety.
The baseline measures, non-negotiable
- HTTPS with a valid SSL certificate: encrypts the connection between visitor and server. Free with most modern hosts (Let's Encrypt), so there's no excuse not to have it.
- Regular updates: CMS, themes, plugins, server. The vast majority of WordPress site hacks exploit flaws that are already known and fixed in versions that simply weren't installed.
- Automatic and tested backups: a backup that has never been restored for verification is not a guarantee. Ideally daily for a site with content that changes, stored on a separate medium from the main server.
- Strong passwords and two-factor authentication on administration access (CMS, hosting, domain name).
- Login attempt limiting to block brute-force attacks on admin login pages.
GDPR: a legal obligation, not a security option
GDPR governs the collection and processing of personal data (forms, cookies, newsletters). It's not exactly a "technical security" measure but a legal obligation that applies to any site collecting data, whatever its size. Concrete points to check:
- A consent banner for non-essential cookies, with a genuine refusal option as easy as acceptance.
- Up-to-date legal notices and privacy policy, specifying who processes the data and why.
- A defined and respected data retention period.
- Forms collecting only strictly necessary data.
Non-compliance with GDPR exposes you to CNIL sanctions, which can be significant for the most serious breaches, even though in practice checks primarily target large organizations or reported complaints. This remains a compliance point to handle from the design stage, not after the fact.
Measures table by risk level
| Site type | Essential measures | Recommended measures |
|---|---|---|
| Simple showcase site (no user account) | HTTPS, updates, backups, GDPR on forms | Login attempt limiting |
| Site with a client area / user account | Everything above + strong authentication, encryption of stored passwords | Connection logging, suspicious activity alerts |
| E-commerce / online payment site | Everything above + PCI-DSS compliance via the payment provider, never storing card numbers directly | Web application firewall (WAF), continuous monitoring |
Who should handle security over time
This is the point many professionals underestimate when creating the site. A site delivered "turnkey" without follow-up leaves the burden of updates and monitoring to its owner, who generally has neither the time nor the skills to do it regularly. A frequent result: a CMS never updated after delivery, and a flaw exploited a year or two later.
Two realistic options to avoid this gap:
- A dedicated maintenance contract with a provider, including regular updates and backups.
- A subscription-based site where hosting, updates, and baseline security are handled continuously by the provider, without separate billing for each intervention.
Warning signs to watch for
A compromised site doesn't always show an obvious symptom immediately. A few signs deserve a quick check:
- Sudden, unexplained slowdown of the site, which can indicate a malicious script running in the background.
- An alert from your host about a mass email send-out or abnormal outgoing traffic.
- Pages or links appearing in Google search results that you never created (often visible via a "site:yourdomain.com" search).
- A browser warning ("not secure" or "dangerous site") when visiting.
- Admin accounts created that you don't recognize.
If in doubt, the first action is to immediately change all admin passwords, then have the site checked by a professional before putting it back into service if a problem is confirmed.
Common mistakes that weaken a site's security
- Keeping the default admin username ("admin"), which makes automated brute-force attacks easier.
- Using the same password for hosting, the domain name, and the CMS, which turns a single leak into a total compromise.
- Leaving an inactive plugin or theme installed on the site: even deactivated, an outdated component remains a potential entry point until it's removed.
- Granting full admin rights to anyone who needs occasional access, instead of rights limited to what's actually necessary.
What to remember
- HTTPS is necessary but not sufficient: updates, backups, and strong authentication complete the baseline protection.
- Most attacks on small sites are automated and exploit known, unpatched flaws, not sophisticated targeted attacks.
- GDPR compliance (cookies, legal notices, retention period) is a legal obligation distinct from technical security, to be handled from the design stage.
- A backup that's never been tested is not a real guarantee of recovery in case of an incident.
- Security over time requires ongoing follow-up (updates, monitoring): a site delivered without maintenance behind it is a site that degrades silently.
Frequently asked questions
Does a small showcase website really need to be secure? Yes, even a site without e-commerce. Most automated attacks on small sites don't target the content but look for an exploitable flaw to send spam, mine cryptocurrency, or redirect traffic. The size of the site is not a protection.
Is HTTPS enough to secure a website? No. HTTPS only encrypts the connection between the visitor and the server, which prevents data from being intercepted in transit. It doesn't protect against a flaw in the code, a weak password, or an outdated plugin. It's a necessary protection, but not a sufficient one.
Who is responsible in case of a hack: me or my provider? It depends on the contract. On a site under maintenance or subscription, the provider is generally responsible for technical updates and server security. On a site delivered without follow-up, the responsibility for maintenance falls back on you, even without the skills to handle it.
How much does securing a professional website cost? The basics (HTTPS, automatic backups, updates) are generally included in decent hosting or a subscription, with no visible extra cost. A one-off security audit for an existing site most often costs between 300 and 1500 euros depending on complexity.
In summary
A website's security isn't a one-off project but ongoing follow-up: HTTPS, updates, tested backups, and GDPR compliance. If your current site hasn't been touched since it went live, that's the most reliable sign that risk is accumulating. The VeryAppi subscription website plan includes hosting in France and continuous technical follow-up, with no separate billing for each security update.
Frequently asked questions
›Does a small showcase website really need to be secure?
Yes, even a site without e-commerce. Most automated attacks on small sites don't target the content itself, they look for an exploitable flaw (a form, an outdated plugin, a weak password) to send spam, mine cryptocurrency, or redirect traffic. The size of the site is not a protection.
›Is HTTPS enough to secure a website?
No. HTTPS only encrypts the connection between the visitor and the server, which prevents data from being intercepted in transit. It doesn't protect against a flaw in the code, a weak password, or an outdated plugin. It's a necessary protection, but not a sufficient one.
›Who is responsible in case of a hack: me or my provider?
It depends on the contract. On a site under maintenance or subscription, the provider is generally responsible for technical updates and server security. On a site delivered without follow-up (WordPress installed once and left as is), the responsibility for maintenance falls back on you, even without the skills to handle it.
›How much does securing a professional website cost?
The basics (HTTPS, automatic backups, updates) are generally included in decent hosting or a subscription, with no visible extra cost. A one-off security audit for an existing site most often costs between 300 and 1500 euros depending on complexity. An application firewall or continuous monitoring adds on for high-traffic or sensitive sites.