Do attackers really go after Kenyan websites?
Yes, and more often than most owners assume. Website security matters for every Kenyan business: automated bots scan millions of sites daily, looking for WordPress installs with old plugins, weak passwords or badly configured servers. A hacked site can then be used to send spam, spread malware or steal customer data.
Ten steps that keep your site safer
1. Use long, unique passwords
Make your WordPress admin password 16 characters or more. Bitwarden, a free password manager, can create and store passwords like that for you.
2. Pick your own admin username
Choose a custom username when you install WordPress, and never log in as "admin".
3. Turn on two-factor authentication
Add Google Authenticator as a second login step. A stolen password alone then gets nobody in without your phone.
4. Keep WordPress core current
Switch on automatic core updates. Most break-ins exploit known weaknesses in older versions.
5. Update plugins and themes every week
Out-of-date plugins are the most common way in for attackers, so check for updates weekly.
6. Install a security plugin
The free Wordfence plugin adds a firewall and malware scans. Sucuri Security is another very good choice.
7. Put a web application firewall in front
Cloudflare's free plan includes a basic WAF and DDoS protection.
8. Serve every page over HTTPS
SSL encrypts traffic between your visitors and your site. Every SiteBoma plan includes a free Let's Encrypt certificate.
9. Take a backup every day
UpdraftPlus can save a daily backup of your site to Google Drive.
10. Host with a provider that takes security seriously
SiteBoma adds server-level firewalls, malware scanning and hosting accounts kept isolated from one another.