To reduce the risk of a website data breach, limit the data you collect, lock down administrator accounts with multifactor authentication (MFA), patch exposed software, keep isolated backups you have tested, and prepare a response plan. No checklist can make a website breach-proof: the right controls depend on your data, technology, staff, host, and other providers.
Start by mapping what your website holds
Make a simple inventory of the personal and business information your site collects, where it is stored or sent, and which people and providers can access it. Include databases, administrator accounts, hosting and cloud services, plugins and other dependencies, and vendors with access to the environment. The Federal Trade Commission (FTC) recommends protecting sensitive data and limiting access to people who need it for their work; its business guide to protecting personal information is a useful starting point.
As an Amazon Associate I earn from qualifying purchases.
- Delete information you no longer need, and avoid collecting information without a clear business purpose.
- Limit staff and vendor permissions to the data and systems required for their work.
- Review access when roles change or a vendor relationship ends, and revoke access that is no longer needed.
The FTC’s Safeguards Rule guidance describes an information-security program that stays current as operations and risks change. The rule applies to covered financial institutions; it is not a universal legal requirement for every website. See the FTC’s Safeguards Rule overview for its scope.
Free tools Windows power users keep installed
One-click scans. No signup required.
Secure every account that can change the site
Require MFA for website administrators, hosting control panels, business email, and other accounts that can access sensitive information or alter the site. Email deserves attention because control of an administrator’s email account can undermine account recovery elsewhere.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Prefer phishing-resistant MFA where a service supports it. CISA recommends hardware-based tokens such as FIDO or Public Key Infrastructure for the greatest resistance to exploitation. It says, “While better than having no additional security layer, Short Message Service (SMS) should be an organization’s last resort for implementing multifactor authentication.” Read CISA’s MFA guidance for implementation detail.
A FIDO-compatible security key is one way to protect accounts that support it. Check compatibility and set up recovery options before relying on a key; it protects supported sign-ins, but it does not patch the website or replace a recovery plan.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Patch software and remove what you do not use
Keep the website platform, plugins, server software, operating systems, and other internet-facing components updated. Prioritize security fixes for vulnerabilities known to be exploited, and remove unused plugins, services, and exposed components where appropriate. CISA’s ransomware guide recommends regular updates and timely patching of internet-facing systems.
Recommended Free Tools
Assign someone to monitor updates and apply them on a defined schedule. For changes that could disrupt the site, use a staging environment or another safe validation process where practical, and know how to restore service if an update causes a problem. Delaying a security update indefinitely because it might cause an issue leaves a known exposure in place; plan and test updates rather than abandoning them.
Rank #3
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Keep backups that can actually restore the site
Choose backup frequency according to how much recent data you can afford to lose and how quickly service must return. Keep encrypted copies offline or otherwise isolated from ordinary administrator access, and test restoration regularly. CISA recommends offline, encrypted backups and regular checks of their availability and integrity in its ransomware guidance.
- Confirm that backups include the data and configuration needed to rebuild the site, not just a copy of its public pages.
- Restrict who can alter or delete backup copies.
- Run restore tests and record whether the result works and how long recovery takes.
A backup that cannot be restored, or that an attacker can change along with production data, may not help. NIST SP 1339, published in June 2026, discusses backup creation, testing, and review during recovery exercises for operational technology. It is OT-specific, so treat it as supporting backup practice rather than a website standard: NIST SP 1339.
Rank #4
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Check what your host and other vendors are responsible for
Ask each provider what systems and data it can access, which software it patches, what logging and alerts it offers, how backups and restores work, and what incident support and customer-notification processes its contract describes. Also clarify which security duties remain yours. FTC small-business materials cover host selection and vendor security, while CISA notes that managed cloud services can reduce some maintenance duties for certain systems without eliminating them.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteUse these questions when comparing providers:
- Which infrastructure and software does the provider patch, and which must you maintain?
- Can administrative access be protected with MFA and limited by role?
- Which security logs and alerts are available, and how long are logs retained?
- Are backups encrypted and isolated, and are restores tested?
- What assistance and notification steps are described for an incident?
- What data can the provider access, and how can you revoke that access?
Relevant FTC guidance is available in its data-protection guide for businesses; CISA’s ransomware guide discusses managed services and shared responsibilities.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Write an incident plan before you need one
Decide in advance who leads a response, who can isolate affected systems, who preserves logs and other evidence, which technical and legal experts to contact, how recovery will be managed, and who communicates with customers or other affected people. Make sure the people named in the plan know their roles and can reach one another if normal systems are unavailable.
The FTC’s Data Breach Response: A Guide for Business recommends mobilizing a response team, preserving evidence, investigating what information was affected, and considering appropriate notification. NIST SP 800-61 Rev. 2 describes incident response from preparation through handling and lessons learned; it was published on August 6, 2012, and its page was updated May 4, 2021. Consult the NIST publication page if you need that framework, and verify current guidance before adopting it as your organization’s current standard.
If you suspect a breach, act carefully and quickly
- Mobilize your response team. Follow your incident plan and bring in qualified technical and legal help as appropriate.
- Secure affected systems and address the vulnerability. Work to contain access without destroying evidence needed to understand what happened.
- Preserve logs and evidence. Record what is known, when actions were taken, and what remains under investigation.
- Review access and determine what information was affected. Use logs and other evidence to assess the incident’s scope.
- Plan communications and notification. Do not make unsupported assurances. Give affected people useful information and keep a record of what you have told them and when you will provide updates.
If personal information was improperly posted on your website, the FTC advises removing it and considering search-engine caches and copies on other sites. Notification duties depend on jurisdiction and incident facts; obtain qualified counsel rather than assuming a universal deadline. The FTC’s breach-response guide provides additional steps.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
