Small blogs assume they're beneath attackers' notice. The reality is the opposite: automated bots scan the entire IPv4 space continuously, and a blog is simply a server with a login form. Nobody needs to know you exist to find you — you're found by default. The good news is that virtually all successful attacks on small sites exploit a short list of neglected basics, and this guide covers exactly those, ordered by how attacks actually happen.
1. Backups first, because everything else fails eventually#
Security is risk reduction, not elimination; the backup is what survives your bad day regardless of cause — hacking, bad plugin update, fat-fingered deletion.
- Automate it. Manual backups die quietly within a month.
- Follow 3-2-1 loosely: copies in more than one place, at least one off the server. A backup stored only on the machine it protects protects nothing.
- Test restoration once. An untested backup is a hope, not a plan. Restore to a scratch folder twice a year and confirm posts come out the other side.
If your publishing model already commits content to git (as this site's does), congratulations — your writing has version history and off-site redundancy by construction. That leaves databases, uploads, and configuration to back up separately.
2. Credentials: the front door attackers actually try#
Bots don't hack; they guess. Credential stuffing uses billions of leaked username/password pairs against every login form they can find, and it succeeds whenever a password was reused anywhere ever.
- Unique password per service, from a password manager. Non-negotiable, zero tradeoffs.
- Two-factor authentication everywhere it exists — registrar, host, email above all. Your email account is the master key: whoever controls it can reset everything else.
- Rate-limit or lock out your own admin login after repeated failures. Most platforms have this built in or one setting away.
The admin authentication on this very site uses timing-safe comparison, per-IP rate limiting, and signed sessions — because a login form on the public internet will be hammered nightly, and that's normal, not paranoia.
3. Updates: boring, decisive#
The overwhelming majority of small-site compromises happen through known vulnerabilities with published patches — exploited weeks or months after fix release, purely because nobody clicked update.
- Turn on automatic updates for the platform itself where offered.
- Review extension/plugin/theme updates weekly; update promptly, and remove anything unused entirely rather than letting it linger unpatched.
- Subscribe to your platform's security announcements feed; it's low-volume and tells you when "update soon" becomes "update now."
4. Least privilege: give each thing only the access it needs#
This principle does more damage control per minute than any other:
- Separate accounts by role. Writing daily under an administrator account means one stolen session owns the whole site. Use an author-level account for work; reserve admin for administration.
- Scope API tokens. A token that publishes posts doesn't need repository deletion rights. Fine-grained tokens limited to specific repos and actions mean a leaked key is an inconvenience, not a catastrophe — and if a token ever does leak in logs or a screenshot, revoke it immediately rather than rotating "later."
- Audit third-party access quarterly. Every integration you granted years ago and forgot is standing permission you'd never grant today.
5. Supply chain and transport: quiet wins#
- HTTPS everywhere, obviously — free certificates have removed every excuse, and browsers now shame sites without them. Keep certificate autorenewal on and glance at it monthly.
- Dependency hygiene: whatever builds your site pulls hundreds of packages. Update dependencies regularly; enable automated alerts for known vulnerabilities in them (GitHub offers this natively).
- Content Security Policy headers limit the blast radius of any injected content getting onto a page — worth configuring once, as this site does alongside standard hardening headers.
The honest threat model#
Notice what's not on this list: exotic penetration testing, security through obscurity, paranoid firewall rituals. A solo blog's realistic adversaries are opportunistic automation and occasional human snoops, and the five items above defeat essentially all of that. Security isn't about being unhackable — it's about being more annoying to compromise than the thousands of unmaintained sites next door, which is a surprisingly low bar cleared by one calm afternoon and a quarterly reminder.
Related: image licensing covers another way blogs get legal trouble, and accessibility basics covers the other kind of site quality audit worth running.
