You don't need to understand every type of website attack to take sensible precautions. Start with who can get in, what software is running and how you'd recover if something went wrong.
There isn't a setting that makes a website completely safe. I prefer to make the everyday risks harder to exploit and make sure somebody is responsible for checking the basics.
Keep the software supported
WordPress, themes, plugins and the packages behind a custom website all need attention. Remove components you no longer use and replace software that is no longer supported.
Apply security updates promptly, with a backup and checks appropriate to the change. For significant changes, test on a separate version first. Don't assume an update worked because the dashboard stopped showing a notice.
Protect the accounts that matter
Use a unique password for each important account, ideally managed with a password manager. Turn on multi-factor authentication where available, and keep recovery codes somewhere secure.
Give each person their own login and only the access their work requires. Remove old staff and supplier accounts. A person editing a page doesn't always need full administrator rights.
Protect hosting, domain registration, email and source-code accounts too. Access to one of those can let someone reset passwords or change where your website points.
The Australian Cyber Security Centre's website guidance covers these same foundations: updates, account protection, hosting and backups.
Check HTTPS, but understand its limits
Your website should use HTTPS without certificate warnings, and its ordinary HTTP address should redirect to the secure one. Make sure someone is responsible for certificate renewals.
HTTPS protects the connection between a visitor and the website. It doesn't tell you whether every plugin, account or form behind it is safe.
Keep the setup as simple as it needs to be
Every extra plugin and integration is another thing to maintain. Before adding one, ask whether it's needed and who will keep it supported.
Your developer should check form data and file uploads on the server, even when the browser already checks them. Unused services and management tools shouldn't stay publicly exposed without a reason.
Those are jobs to discuss with whoever manages the site. You don't need to experiment with unfamiliar security settings on a live business website.
Keep recovery separate from prevention
Even a carefully maintained site needs backups. Store an independent copy outside the live hosting account and test that it can be restored.
Keep enough history to recover from a point before a problem began. If a site has been compromised, fix the cause as well as restoring the files. Otherwise the same access route may still be there.
The website backup guide explains how to check what your copies contain.
Pay attention to useful warnings
Someone should review alerts about unexpected administrator accounts, changed files, repeated failed logins, malware and service availability. Domain and certificate expiry notices need an owner too.
You don't need endless notifications. You need the right person to notice a meaningful change and act on it.
Limit the customer information you collect and who can access it. Apply a sensible retention policy rather than leaving old exports and enquiry records scattered across accounts.
If you suspect a compromise
Stop making unrelated changes. Record what you've noticed and get technical help to preserve logs and evidence. Depending on the incident, access may need restricting while it's investigated.
Change affected credentials from a trusted device, check for other access routes, and recover from a known clean source. Test the recovered site. Where personal data may be involved, get advice about any reporting or customer-notification duties.
If you want help reviewing the everyday setup, tell me about your website. I'll explain what I can check and when a specialist would be more appropriate.