Keep your CMS, themes, plugins, and custom applications updated. Remove unused software, use unique administrator accounts, restrict file permissions, and install only trusted extensions. Enable HTTPS and maintain independent backups.
Use security scanning or protection services when appropriate, monitor unexpected file changes, and investigate unusual redirects, new administrators, spam, or resource usage promptly. If a site is compromised, change affected credentials from a clean device and open a support ticket with the domain and symptoms.
