On this page
Key takeaways
- Small sites are attacked by automated scanners, not by people who chose them; basic hygiene stops most of it.
- Out-of-date plugins and pirated themes are the most common way in.
- Backups only count if you have tested restoring one.
- Protect the domain and DNS accounts as carefully as the website itself.
Most attacks on Nepali business websites are not personal. Automated scanners sweep the internet looking for old plugins, weak passwords and exposed admin pages, and they hit every site they find. The result is defaced home pages, spam links injected into your content, or a hijacked admin account. The good news is that a short list of fixes stops most of it.
What attackers actually want
- Your server, not your data. To send spam, host phishing pages or mine cryptocurrency.
- Your search ranking. Hidden links and pages that ride on your domain's reputation.
- Your admin login. To take over the site, or to try the same password elsewhere.
- Your customers. Through fake payment pages or redirects to scams.
The 12-point checklist
| Fix | Effort | Why it matters |
|---|---|---|
| HTTPS everywhere, with HSTS | Low | Stops snooping and tampering on public wifi |
| Update core, plugins and themes | Low, ongoing | Old plugins are the most common way in |
| Remove unused plugins and themes | Low | Code you do not use can still be exploited |
| Never use nulled themes or plugins | None | Pirated copies commonly carry backdoors |
| Strong, unique admin passwords | Low | Stops credential stuffing from other leaks |
| Two-factor authentication | Low | A stolen password alone is no longer enough |
| Least-privilege staff accounts | Low | A compromised editor cannot install code |
| Off-site backups, test-restored | Medium | Turns a disaster into an afternoon's work |
| Cloudflare or a WAF in front | Medium | Blocks known attacks and floods before your server |
| Security headers and CSP | Medium | Limits what injected scripts can do |
| Secrets in environment variables | Low | Keys in code or Git leak with the code |
| Logging and alerts | Medium | You find out in minutes, not months |
Updates and plugins: where most breaches start
On WordPress sites, the most common way in is a plugin with a known vulnerability that was never updated. Update promptly, remove what you do not use, and choose plugins that are actively maintained. Never install a "nulled" premium theme or plugin downloaded for free from an unofficial site — they are a well-known way of distributing malware.
Logins and accounts
Give every staff member their own account, with only the permissions their job needs. Turn on two-factor authentication for every admin. Remove accounts promptly when someone leaves. Shared logins make it impossible to tell who did what, and impossible to revoke one person's access without changing everyone's.
Backups that actually work
A backup stored on the same server as the website disappears with it. Keep backups somewhere else, automatically, and keep several days or weeks of history so you can go back to before a problem started. Then test: restore a backup to a separate copy of the site at least once. Many businesses discover their backups were empty or incomplete only on the day they needed them.
A shield in front: Cloudflare and headers
Putting the site behind Cloudflare or a similar service adds a web application firewall, rate limiting and bot protection, and hides your server's real address. Security headers such as Content-Security-Policy, HSTS and X-Content-Type-Options tell browsers to refuse many kinds of injected content. None of these replace updates, but they reduce what an attacker can do.
Payments, secrets and the domain
If you accept eSewa, Khalti or other payments, verify every payment server to server before marking an order paid; our online payments guide explains why. Keep merchant keys and API secrets in server environment variables, never in front-end code or a Git repository.
Finally, protect the accounts that sit above the website: your domain registrar and your DNS provider. Whoever controls those can redirect your site and your email. Use two-factor authentication on both and renew domains well before they expire.
The first hour after a hack
- Do not panic-delete files. Take the site offline or into maintenance mode if customers are at risk.
- Change every admin, hosting, database and FTP password, and sign out all sessions.
- Note when the problem started and what changed, and keep a copy of the compromised site for investigation.
- Restore from a clean backup taken before the compromise, then update everything before going live again.
- Find and close the way in — usually an outdated plugin or a stolen password — or it will happen again.
- If customer data or payments may be affected, tell the people affected and take advice on your obligations.
- Check Google Search Console for security warnings and request a review once the site is clean.
Where to start
This week: turn on two-factor authentication for every admin, update or remove every plugin, and confirm where your backups are and when one was last restored. Those three steps close the most common doors. For a full review, our cybersecurity service checks your site, hosting and accounts and gives you a prioritised list. If you are rebuilding anyway, our web development work ships with these protections from day one.
Frequently asked questions
Usually they did not choose you. Automated tools scan millions of sites for known weaknesses and exploit whatever they find, to send spam, host scam pages or borrow your search ranking.
WordPress itself is well maintained. Most WordPress breaches come from outdated or pirated plugins and themes, and weak admin passwords. Kept updated, with few, reputable plugins and two-factor login, it can be run safely.
It helps a great deal, blocking many attacks and floods before they reach your server, but it does not fix an outdated plugin or a stolen password. Treat it as one layer, not the whole answer.
Daily for most business sites, and more often for shops or anything taking bookings. Keep the backups off the server, keep several days of history, and test a restore at least occasionally.
- website security nepal
- website security checklist
- wordpress security
- hacked website nepal