Summary
This guide shows how to protect your website with SSL/TLS, a WAF, the OWASP Top 10 and GDPR compliance. IBM's Cost of a Data Breach Report 2025 puts the average cost of a breach at USD 4.44 million worldwide, and many of the measures here cost little.
- A data breach costs USD 4.44 million on average worldwide and USD 10.22 million in the USA (IBM, 2025)
- A Web Application Firewall (WAF) filters automated attacks like SQL injection and XSS before they reach your site
- Many successful attacks exploit known vulnerabilities for which patches already exist
- GDPR violations can result in fines up to 20 million EUR or 4% of annual worldwide turnover
- 2FA on every admin account makes stolen passwords far less useful to attackers
In its 2025 report, Germany's Federal Office for Information Security (BSI) describes the IT security situation as still tense. No business is too small to be hit, because bots scan the whole internet for known gaps. A single breach can cost you customer data, search rankings and weeks of work. This guide covers each layer of protection you need.
Current threat landscape 2026
Cyberattacks are faster and more automated than they were five years ago. AI-powered tools, exploit kits and organized criminal groups have cut the cost and effort it takes to launch an attack. Sooner or later, your site will be a target.
Figures with sources:
- USD 4.44 million average cost of a data breach worldwide, down from USD 4.88 million the year before (IBM Cost of a Data Breach Report 2025)
- USD 10.22 million average cost of a breach in the USA (same report)
- 241 days average time to identify and contain a breach (same report)
- The BSI describes the IT security situation in Germany in 2025 as still tense (BSI situation report 2025)
Most common attack vectors
Automated attacks
Bots scan the internet for known vulnerabilities, and attacks often start soon after a vulnerability is disclosed. Bots do not pick targets by size, so no business is too small to be hit.
Phishing and social engineering
Attackers use fake emails and websites to steal credentials. AI makes these attacks more and more convincing: deepfake voices and personalized spear-phishing are now common.
Ransomware
Attackers encrypt your data and demand a ransom. Many now also threaten to publish the stolen data (double extortion).
Supply chain attacks
Attackers compromise plugins, themes or dependencies. One hacked npm package can put thousands of sites at risk, and the SolarWinds attack showed that even enterprises are vulnerable.
Industry-specific threats
Attackers want different things from different industries: payment data from e-commerce sites, patient records from healthcare and confidential client information from professional services.
| Industry | Primary threat |
|---|---|
| Healthcare | Ransomware, data theft |
| Financial services | Credential theft, fraud |
| E-commerce | Payment skimming, account takeover |
| Professional services | Client data theft |
| Manufacturing | IP theft, ransomware |
SSL/TLS encryption: the foundation
An SSL/TLS certificate encrypts the communication between browser and server. Google uses HTTPS as a ranking signal, and browsers mark HTTP pages as "Not Secure". Visitors who see that warning stop trusting the site on the spot.
SSL certificate types:
- Let's Encrypt (DV): Free, auto-renewable, sufficient for most websites. Validates domain ownership only.
- Organization Validated (OV): Paid. Validates that your organization exists.
- Extended Validation (EV): Paid, with full business verification. Browsers no longer show a special indicator for EV, so it adds little for most sites.
- Wildcard certificates: Cover all subdomains (*.yourdomain.com). Useful for complex setups.
Essential SSL configuration
- Enable HSTS: HTTP Strict Transport Security forces HTTPS for all future connections. Add your domain to the preload list for maximum protection.
- Use TLS 1.3: Latest protocol with improved speed and security. Disable TLS 1.0/1.1 completely.
- OCSP Stapling: Speeds up certificate verification by caching OCSP responses on your server.
- CAA Records: DNS records that limit which Certificate Authorities can issue certificates for your domain.
- Certificate Transparency: Make sure your certificates appear in CT logs so you can monitor them.
Important: mixed content
One HTTP resource on an HTTPS page breaks the secure connection indicator. Audit all images, scripts, fonts, and iframes to ensure they load over HTTPS.
Testing your SSL configuration
Use these free tools to verify your SSL setup:
- SSL Labs Server Test: Detailed analysis with letter grade (aim for A+)
- Security Headers: Checks HSTS and other security headers
- Mozilla Observatory: Broad security assessment of your site
Secure authentication
Weak or stolen passwords are one of the most common ways attackers get in. Strong authentication is your first line of defense against unauthorized access.
Password policy requirements:
- Minimum 14 characters with uppercase, lowercase, numbers, special characters
- Two-Factor Authentication (2FA) mandatory for all admin access
- Password manager for teams (for example 1Password or Bitwarden)
- No password reuse between services: a unique password for every account
- Passkey support where possible (WebAuthn/FIDO2), the passwordless option
- Breach monitoring: check passwords against known breach databases
2FA options ranked by security:
- 1. Hardware keys (YubiKey, Titan):
The most secure option: phishing-resistant and impossible to intercept. They should be mandatory for high-value accounts.
- 2. Authenticator apps (TOTP):
Google Authenticator, Authy or Microsoft Authenticator. They offer good security and are widely supported.
- 3. Push notifications:
Duo or Okta. They are convenient, but open to push fatigue attacks when users approve without thinking.
- 4. SMS codes:
Better than nothing, but vulnerable to SIM swapping. Use them only as a fallback.
- 5. Email codes:
The weakest option, acceptable only if the email account itself has strong 2FA.
Admin access best practices
- Principle of least privilege: Only grant the minimum access each role needs
- Separate admin accounts: Do not use your everyday email account for admin access
- IP whitelisting: Restrict admin access to known IP addresses where possible
- Session timeouts: Log users out automatically after 15-30 minutes of inactivity
- Login attempt limits: Lock accounts after 5 failed attempts
Keeping software updated
Many successful attacks exploit known vulnerabilities for which patches already exist. Any business that takes security seriously has to install updates regularly.
WordPress
- Enable automatic core updates
- Minimize plugins, since each one adds attack surface
- Only use plugins from the official wordpress.org repository
- Delete unused plugins completely (not just deactivate)
- Keep themes updated, because theme vulnerabilities are common
- Use a managed WordPress host for automatic security patching
Custom code (Node.js, PHP, Python)
- Run npm audit / composer audit / pip audit regularly
- Enable Dependabot or Renovate for automatic updates
- Apply critical security updates within 24 hours
- Run automated security tests in your CI/CD pipeline
- Commit lock files (package-lock.json, composer.lock)
- Pin major versions, auto-update patches
Vulnerability management process
Discovery
Subscribe to security advisories, run automated scanning tools and monitor CVE databases.
Assessment
Evaluate severity (CVSS score), exploitability, and impact on your specific setup.
Prioritization
Critical (CVSS 9+): 24 hours. High (7-8.9): 1 week. Medium (4-6.9): 30 days.
Remediation
Test in staging, then deploy to production. Document the change.
Web application firewall (WAF)
A WAF filters malicious traffic before it reaches your website. It blocks a large share of automated attacks and adds a security layer between attackers and your application.
What a WAF protects against:
SQL injection
Attackers inject SQL commands through forms to manipulate databases, steal data, or bypass authentication.
Cross-site scripting (XSS)
Attackers inject malicious JavaScript to steal user data or session cookies, or to redirect users to phishing sites.
DDoS attacks
Millions of simultaneous requests overload the server. You need a WAF with rate limiting and bot detection.
Bot traffic
Automated attacks, content scraping, credential stuffing, inventory hoarding on e-commerce sites.
Remote file inclusion (RFI)
Attackers inject remote files containing malicious code through vulnerable file include functions.
Zero-day protection
Virtual patching protects you against new vulnerabilities right away, before the official patches are out.
Recommended WAF providers:
| Provider | Best for | Pricing |
|---|---|---|
| Cloudflare | Most websites, easy setup, global CDN | Free plan with basic rules, paid plans with more |
| Sucuri | WordPress sites, includes malware cleanup | Paid plans |
| AWS WAF | AWS-hosted applications, highly configurable | Pay-per-use |
| Imperva | Enterprise, highly sensitive applications | Custom pricing |
Understanding the OWASP Top 10
The OWASP Top 10 lists the most critical security risks for web applications. If you own or build a website, you should know these risks and protect against them.
OWASP Top 10:2025 (current edition):
- A01: Broken Access Control. Users reach data or functions they should not see. It holds the top spot again.
- A02: Security Misconfiguration. Default credentials, unnecessary features enabled, missing hardening.
- A03: Software Supply Chain Failures. Vulnerable or compromised dependencies, packages and build tools.
- A04: Cryptographic Failures. Weak or missing encryption and exposed sensitive data.
- A05: Injection. SQL, NoSQL, OS command and other injection attacks through untrusted input, including XSS.
- A06: Insecure Design. Flaws in design and architecture that implementation alone cannot fix.
- A07: Authentication Failures. Weak passwords, missing 2FA, session management issues.
- A08: Software or Data Integrity Failures. Code and data from untrusted sources, used without verification.
- A09: Security Logging and Alerting Failures. Insufficient logging, no monitoring, no alerts when an attack happens.
- A10: Mishandling of Exceptional Conditions. Errors and edge cases the application handles badly, for example by failing open or leaking details in error messages.
Quick wins against the OWASP Top 10
- Parameterized queries: Prevent SQL injection
- Content Security Policy: Mitigates XSS attacks
- Proper access controls: Check permissions on the server, not only in the UI
- Dependency scanning: Automated alerts for vulnerable packages
- Security headers: X-Frame-Options, X-Content-Type-Options, Referrer-Policy
GDPR compliance
Data protection is not optional in Europe. Violations can result in fines of up to 20 million EUR or 4% of annual global turnover, whichever is higher. On top of the fines, a breach can damage your reputation and customer trust for years.
GDPR compliance checklist:
- SSL/TLS encryption for all pages (not just checkout)
- Current, complete privacy policy in plain language
- Cookie banner with genuine opt-in (no pre-ticked boxes, no "consent wall")
- Data Processing Agreements (DPAs) with all service providers
- No analytics or tracking without explicit consent
- Data deletion concept and documented procedures
- Records of Processing Activities (RoPA)
- Data Protection Impact Assessment (DPIA) where required
- Appointed Data Protection Officer if processing at scale
Warning: Google Analytics
Using Google Analytics without consent is not GDPR-compliant in the EU. Several data protection authorities have issued rulings against it. Privacy-friendly alternatives: Plausible, Fathom, Matomo (self-hosted), or Simple Analytics.
Data subject rights
Under GDPR, individuals have specific rights you must support:
- Right to Access: Users can request all data you hold about them
- Right to Rectification: Correction of inaccurate data
- Right to Erasure: The "right to be forgotten", deletion on request
- Right to Portability: Provide data in machine-readable format
- Right to Object: Opt-out of direct marketing
Incident response: when it happens
The earlier you detect an attack, the less damage it causes. According to IBM, it took organizations 241 days on average in 2025 to identify and contain a breach.
Implement monitoring:
- Uptime monitoring: Pingdom, UptimeRobot or StatusCake tell you the moment your site goes down
- Security scanning: Sucuri, Wordfence or Detectify for automated vulnerability detection
- Log analysis: Centralized logging with alerts for suspicious patterns (failed logins, unusual traffic)
- File integrity monitoring: Detect unauthorized file changes, which is essential for finding backdoors
- Web traffic analysis: Identify unusual patterns like traffic spikes from specific regions
Incident response plan:
Detection and isolation
Take the website offline immediately to prevent further damage, document the attack indicators and preserve the evidence.
Evidence preservation
Secure logs, modified files and access records, and create forensic copies before you change anything. You may need them in legal proceedings.
Cleanup and eradication
Remove malware, find and remove backdoors, and restore from a clean backup. Removing the visible malware is not enough, because attackers often plant several access points.
Hardening
Close the vulnerability the attackers exploited, change all passwords, apply all pending updates and review access controls.
Notification and documentation
After a data breach, GDPR requires notification to the supervisory authority within 72 hours. Document everything for compliance and to prevent the next incident.
GDPR breach notification requirements:
- 72 hours: Notify supervisory authority if breach poses risk to individuals
- Without undue delay: Notify affected individuals if high risk to their rights
- Documentation: Record all breaches even if not reported, including facts, effects, and actions taken
Complete security checklist
- SSL/TLS certificate active with HSTS enabled
- Strong passwords + 2FA for all admin accounts
- All software, plugins, and dependencies updated
- Web Application Firewall (WAF) active and configured
- Automatic daily backups following the 3-2-1 rule
- GDPR compliant (privacy policy, cookie consent, DPAs)
- Security headers configured (CSP, X-Frame-Options, etc.)
- Monitoring and incident response plan in place
Frequently asked questions: website security
How do I know if my website has been hacked?
How much does an SSL certificate cost?
How often should I create backups?
Is WordPress secure?
What is a Content Security Policy (CSP)?
Do I need a Web Application Firewall (WAF)?
What do I need for GDPR compliance?
How do I protect against DDoS attacks?
Sources & references
We checked and used these sources for this article:
Documentation
- 01
- 02
- 03
- 04
- 05
Research
- 01
- 02
Get your website's security checked
We check your website for vulnerabilities and write a concrete action plan to protect your business. The first consultation is free, and after it you get an individual quote.