How do I secure my website from hackers?

The common entry points are outdated software and weak logins. Old WordPress plugins, reused passwords, and unused admin accounts cause a large share of break-ins. Update everything promptly, delete plugins and users you don't need, give each person only the access they require, and turn on two-factor authentication for every admin.

Add layers on top. An SSL certificate (free via Let's Encrypt, and standard with good hosting) encrypts traffic; a web application firewall or reputable security plugin blocks common attacks; and automatic, off-site backups mean that even in a worst case you can restore quickly. Keeping the server patched and adding security headers help too.

Finally, assume something could eventually go wrong and plan for it. Regular backups you have actually tested restoring from are the single most valuable safeguard. On a custom build, confirm your developer follows secure coding practices, and make sure you own the hosting and code so you can act fast if there is ever an incident.