How to Protect Yourself from Hackers – Essential Security Measures

Every second, a new cyberattack is launched somewhere in the world. This is no longer a problem limited to multinational corporations and government agencies. Small businesses, online store owners, entrepreneurs and ordinary users who believe they have “nothing worth stealing” are also targeted.

A hacked website, stolen customer data or files locked by ransomware can threaten a business built over many years. However, basic protection does not have to be complicated or expensive. You simply need to know which measures to implement.

Protection against hackers is built in layers: strong passwords and a password manager, two-factor authentication (2FA), an SSL certificate, regular data backups, updated software and user education. Together, these measures eliminate a large proportion of common cyber risks.

What Is the Real Cost of a Cyberattack?

Let us begin with data, as it provides a clearer picture than general statements.

According to IBM’s 2024 Cost of a Data Breach Report, the average global cost of a data breach reached $4.88 million, a record figure and a 10% increase compared with the previous year. This average includes large organisations such as hospitals, banks and technology companies. However, smaller businesses can still face losses amounting to tens of thousands of euros, including direct recovery costs and the loss of customer trust.

Verizon’s 2024 Data Breach Investigations Report (DBIR) highlights another important figure: 68% of data breaches involve a human factor, including employee error, fraud or social manipulation. Technical vulnerabilities remain a serious issue, but people are still the weakest link.

Who Is Actually Being Targeted?

There is a common misconception that hackers only target large companies. In reality, automated attacks affect anyone who is not adequately protected.

● According to the CNBC Cybersecurity Survey, 43% of all cyberattacks target small and medium-sized businesses
● Smaller companies are attractive targets because they often have weaker security
● Online stores are particularly vulnerable because they process and store customer payment data
● WordPress websites are continuously targeted by automated bots throughout the day

What Are the Most Common Types of Cyberattacks?

Before discussing solutions, it is useful to understand the threats you may face.

Phishing – An Attack Delivered to Your Inbox

Phishing is by far the most common type of cyberattack and has remained in that position for years.

A hacker sends an email that appears to come from a bank, PayPal, Google or even a colleague. You click a link, enter your password and unknowingly provide the attacker with access.

Examples of phishing in practice:

● An email from “your bank” requesting urgent confirmation of personal details
● A message from “Google” claiming that your account has been compromised
● A fake invoice from a “supplier” containing an Excel attachment with malware
● A WhatsApp or Viber message from an “acquaintance” containing a link to a fake login page

According to research by Proofpoint, more than 3.4 billion phishing emails are sent every day.

Brute-Force Attacks – Automated Password Guessing

A program tests thousands of password combinations every second until it identifies the correct one.

The password “123456” can be cracked in less than a second. Even a password such as “Milan2023” may be compromised within minutes.

Ransomware – Extortion Through File Encryption

An attacker encrypts your files, including documents, databases and photographs, and demands a ransom, usually in a cryptocurrency such as Bitcoin or Monero, in exchange for restoring access.

Modern ransomware attacks may also target backup copies, meaning that simply having a backup is not always enough.

According to Statista, ransomware attacks cost businesses worldwide more than $20 billion in 2023.

SQL Injection – An Attack on a Website Database

This type of attack is particularly relevant to website and online store owners.

A hacker inserts malicious code through a search form, login field or comment section and may gain access to the entire database, including users, passwords and payment information.

Social Engineering – Manipulation Rather Than Code

Some of the most sophisticated attacks do not require a single line of code.

The attacker impersonates IT support, a supplier or even the company director in a form of “CEO fraud”. They then persuade an employee to transfer money, disclose a password or open a malicious attachment.

This is why staff education is just as important as technical protection.

Man-in-the-Middle Attacks – Interception on Public Networks

On public Wi-Fi networks in cafés, airports or hotels, an attacker may position themselves between you and the server you are communicating with.

They can then monitor the information you send, including passwords, payment details and business messages.

HTTPS encrypts communication and makes this type of interception significantly less useful to an attacker.

Essential Protection: What You Should Do

1. Strong Passwords and a Password Manager

This is the foundation of every security system.

What Makes a Strong Password?

● At least 14 to 16 characters
● A combination of uppercase and lowercase letters, numbers and symbols
● No personal names, dates of birth, company names or dictionary words
● Completely different from passwords used for other accounts

The average user has between 70 and 80 online accounts. No one can realistically remember 80 unique, strong passwords, nor should they have to.

Password managers generate, store and automatically enter passwords. You only need to remember one master password.

Popular Password Managers

Tool	Price	Platforms	Notes
Bitwarden	Free basic plan	All platforms	Open-source and an excellent option
1Password	Approximately $3 per month	Windows, Mac, iOS and Android	One of the most popular options for businesses
Dashlane	Approximately $5 per month	All platforms	Includes a VPN
KeePassXC	Free	Desktop	Fully local, without cloud storage

The most common mistake is reusing the same password across multiple accounts. If one service is compromised, all other accounts using that password may also be exposed.

You can use haveibeenpwned.com to check whether your email address has appeared in a known data breach.

2. Two-Factor Authentication (2FA)

Two-factor authentication means that, in addition to a password, you need a second factor to sign in. This is usually a six-digit code generated on your phone.

Microsoft and Google have reported that 2FA blocks more than 99.9% of automated account attacks. It is one of the most effective security measures and requires very little effort.

Types of 2FA, from Least to Most Secure

● SMS code – the simplest option, but not ideal because of the risk of SIM-swapping attacks
● Authenticator application – a better choice, such as Google Authenticator or Microsoft Authenticator
● Hardware security key – a device such as YubiKey that is connected through a USB port and provides a very high level of security
● Passkeys – a newer standard gradually replacing passwords and supported by Apple, Google and Microsoft

Accounts Where 2FA Should Be Enabled Immediately

● Business email accounts
● Banking and payment accounts
● Domain registrar and hosting control panels
● WordPress, Magento or other platform administrator accounts
● Google Analytics, Google Ads and Facebook Business Manager
● Cloud services such as Google Drive, Dropbox and OneDrive

3. SSL Certificates and HTTPS – A Requirement, Not an Option

If your website still uses HTTP instead of HTTPS, this is a problem for both security and SEO.

An SSL certificate encrypts communication between the user and your server. Without encryption, exchanged information such as passwords, payment details and personal data may be intercepted.

What Happens Without SSL?

● Chrome and Firefox display a “Not secure” warning that may discourage visitors
● Google may rank non-HTTPS websites less favourably in search results
● Accepting payments on an online store without SSL is practically impossible and may not meet legal or compliance requirements

A free SSL certificate can be obtained through Let’s Encrypt, which is supported by almost every hosting provider.

Every website delivered by RedWood Digital includes an SSL certificate as a standard feature, without an additional charge.

4. Regular Software Updates

Updates are not only about new features. Their primary purpose is often to fix security vulnerabilities.

Software That Should Be Updated Regularly

● Operating systems, including Windows, macOS and Linux servers
● Web browsers such as Chrome, Firefox and Edge
● WordPress core, themes and plugins
● Online store platforms such as Magento, WooCommerce and Shopify
● Antivirus and anti-malware software
● Router firmware, which is often overlooked

Enable automatic updates wherever possible.

For a business website, arrange regular technical maintenance with your development team, including monthly checks of software versions and security patches.

5. Backup Strategy – The Final Line of Defence

Even the best security cannot guarantee that an attack will never occur. A reliable backup ensures that recovery is possible when something goes wrong.

The Golden Rule: The 3-2-1 Backup Strategy

● Keep 3 copies of your data
● Store them on 2 different types of media or in different locations
● Keep 1 copy offline or in a separate location

Example for an Online Store

1. Automatic daily backup on the hosting server
2. Weekly backup on an external drive or NAS device in the office
3. Monthly backup in a cloud service such as Amazon S3, Google Cloud Storage or Backblaze

How Often Should You Create Backups?

Type of Website	Recommended Frequency
Blog that is rarely updated	Weekly
Corporate website	Weekly
Active online store	Daily
Website with user-generated content	Several times per day

Periodically test whether your backups can actually be restored.

Many businesses only discover that their “backup” does not work when they urgently need it.

6. Firewall and WAF – A Protective Barrier for Your Website

A firewall filters traffic to your server and blocks suspicious requests before they reach the website.

A Web Application Firewall, or WAF, is a specialised firewall for web applications. It protects against SQL injection, cross-site scripting, brute-force attempts, and similar threats.

Cloudflare is one of the most widely used services, combining a CDN, DDoS protection, and a WAF.

Its free plan covers basic requirements, while the Pro and Business plans provide more advanced protection for companies.

As discussed in our article about the sudden increase in traffic from China, Cloudflare WAF can block bot traffic and suspicious visitors before they reach the server.

Popular Security Plugins for WordPress

● Wordfence – scans for malware, blocks brute-force attacks and includes a built-in WAF
● iThemes Security – a comprehensive WordPress security solution
● Sucuri Security – a cloud-based WAF and malware scanner

7. Email Account Security – The Entry Point to Everything Else

Email is one of the most attractive targets for hackers because it provides access to many other accounts.

Anyone who controls your email can reset passwords for banking services, hosting accounts, social networks and other platforms.

Practical Measures for Email Security

● Always enable 2FA on business email accounts
● Use an email address on your business domain rather than a personal Gmail account for company communication
● Implement SPF, DKIM and DMARC records to protect against email domain spoofing
● Train employees to recognise phishing messages
● Never send passwords, payment card details or sensitive information by email

8. Online Store Security

Online stores require additional protection because they process customer payment information.

A data breach may have legal and financial consequences, including regulatory penalties and the loss of trust built over many years.

PCI DSS Compliance

If you accept payment cards, you must comply with the Payment Card Industry Data Security Standard, or PCI DSS. These standards are defined by Visa, Mastercard and other payment networks.

The simplest way to support compliance is to use certified payment gateways that manage payment security on your behalf.

● Stripe – a comprehensive solution with strong developer support
● PayPal – globally recognised and trusted by customers
● Braintree – a popular choice for larger online stores

Specific Measures for E-Commerce Websites

● CAPTCHA on registration and login forms
● A limited number of failed login attempts, with account lockout after five attempts
● Automatic detection of suspicious transactions
● Regular updates of the platform and extensions
● Removal of old and unused plugins or modules
● Collection and storage of only the customer data that is genuinely required

When we build online stores using Magento, WooCommerce, Shopify or BigCommerce, security is integrated into the development process.

9. Employee Education – The Strongest and Weakest Link

According to Verizon’s DBIR, 68% of data breaches involve human error.

Technical protection is ineffective if an employee clicks a phishing link or sends a password to a supposed member of the IT team who is actually an attacker.

Security Training Should Cover

● How to recognise phishing emails and text messages
● Password policies and the use of password managers
● Information that must never be sent by email, including passwords and payment card details
● Safe remote working practices, including VPN use and secure Wi-Fi
● The designated contact person in the event of a suspicious incident

10. VPN – Protection on Public Networks

A VPN, or Virtual Private Network, encrypts your internet traffic and hides your real IP address.

It is particularly useful when working on public Wi-Fi networks in cafés, hotels or airports.

Recommended VPN Services

● Mullvad – focused on privacy and does not retain activity logs
● Proton VPN – a Swiss provider with a strong reputation for privacy
● ExpressVPN – fast and reliable, although more expensive
● NordVPN – popular and suitable for everyday use

A VPN does not solve every security problem, but it provides an important additional layer when combined with other measures.

Free Tools for Checking Security

Before implementing new protection, it is useful to assess your current security level.

Tool	What It Checks
SSL Labs – ssllabs.com/ssltest/	SSL certificate configuration
Sucuri SiteCheck – sitecheck.sucuri.net	Website malware and blacklist status
Have I Been Pwned – haveibeenpwned.com	Whether your email has been exposed in a breach
Mozilla Observatory – observatory.mozilla.org	Security headers and website configuration
VirusTotal – virustotal.com	URL and file scanning

Security Checklist – Review Each Item

Passwords and Access

● All passwords are at least 14 characters long
● I use a password manager
● 2FA is enabled on all critical accounts
● I do not reuse passwords across different accounts

Website and Hosting

● The SSL certificate is active and the website address begins with https://
● The CMS, platform and all plugins are up to date
● Unused plugins and themes have been removed
● The login page is protected against brute-force attacks
● Administrator access is secured with strong credentials

Backups

● Automatic daily or weekly backups are configured
● Backups are stored in an external location, not only on the same server
● I have tested the backup restoration process

Network and Email

● I use a VPN on public Wi-Fi networks
● SPF, DKIM and DMARC are configured for the company email domain
● Employees know how to recognise phishing attempts

Monitoring

● I monitor server logs or have an alert system in place
● I know who to contact in the event of an incident

What Should You Do If a Cyberattack Has Already Occurred?

A fast response is essential.

Priority steps include:

1. Isolate the problem – immediately disconnect the compromised device from the network
2. Change all passwords – begin with the email account and act without delay
3. Enable 2FA – activate it on every account that does not already use it
4. Review server logs – determine what was accessed and when
5. Restore the website from a clean backup – if the website has been compromised
6. Notify the relevant parties – inform customers and business partners if their data has been exposed
7. Report the incident – in Serbia, the relevant authorities include CERT.RS and the Ministry of Internal Affairs

For online store owners, a customer data breach may create a legal obligation to notify the relevant authorities under Serbia’s Personal Data Protection Act and the GDPR where customers from the European Union are affected.

FAQ – Frequently Asked Questions

Is Antivirus Software Enough?

No.

Antivirus software is useful, but it is only one component of a wider security system.

Without strong passwords, 2FA, regular backups and user education, antivirus software cannot stop every type of attack.

Modern cybersecurity requires several layers of protection.

How Can I Tell Whether My Website Has Been Hacked?

Signs of a compromised website may include:

● Unexpected redirection to other websites
● Unknown content appearing on pages
● Google warnings about malware
● A sudden decline in organic traffic
● Notifications from the hosting provider about suspicious activity

You can perform a quick check using Sucuri SiteCheck.

Is a Free Let’s Encrypt SSL Certificate Sufficient?

For most websites, yes.

Let’s Encrypt provides the same level of encryption as paid SSL certificates.

Paid Extended Validation certificates may include additional company verification and a financial warranty, but a Let’s Encrypt certificate is sufficient for standard websites and online stores.

Are WordPress Websites Particularly Vulnerable?

WordPress powers approximately 43% of all websites, making it an attractive target for automated attacks.

However, the main risk does not come from WordPress itself. It usually comes from outdated plugins, weak passwords and poor configuration.

A properly configured and regularly updated WordPress website can be secure.

Which 2FA Method Is the Most Reliable?

Hardware security keys such as YubiKey provide the highest level of protection.

They are physical devices connected through a USB port and are much more difficult to compromise through software-based attacks.

For everyday use, an authenticator application such as Google Authenticator or Authy offers an effective balance between security and convenience.

SMS verification is the weakest option because of the risk of SIM-swapping attacks.

Do Small Businesses Really Need to Worry About Cybersecurity?

Yes.

Small businesses are often attractive targets precisely because their security is weaker than that of large corporations, while they may still hold valuable customer and business data.

The consequences of a breach may also be proportionally more serious for a small company that does not have a dedicated security team.

How Can I Recognise a Phishing Email?

Look for the following warning signs:

● Artificial urgency, such as “Confirm your account immediately or you will lose access”
● Spelling and grammar mistakes
● A link that does not lead to the genuine domain – always hover over the link before clicking
● A request for a password or payment card information by email
● A suspicious sender address, such as office@g00gle.com instead of an address ending in @google.com

Does a VPN Make a Website More Secure?

A VPN primarily protects your device and internet connection.

It encrypts traffic and helps protect you on public networks.

The website itself must be protected through other measures, including SSL, a WAF, and secure server configuration.

Use a VPN when accessing your website’s administration panel from an unsecured network.

Conclusion

Cybersecurity is not a one-time project. It is an ongoing process.

Hackers continually develop new techniques, and security measures must evolve with them.

The good news is that basic protection is neither particularly complicated nor expensive.

Strong passwords and a password manager, two-factor authentication, an SSL certificate, regular backups, and updated software are five measures that together eliminate a large proportion of common risks.

For website and online store owners, security is an essential part of a professional online presence.

If you need support with website security configuration, technical maintenance, or the development of a secure business website from the ground up, contact us. We will help you find the right solution for your requirements.