For most Pakistani businesses the website is the front door: it takes enquiries, runs the online store and carries the brand. It is also the asset attackers reach most easily. Hacked business sites in Pakistan are usually compromised through outdated plugins, nulled themes, weak admin passwords or abandoned hosting accounts, not clever zero-day attacks. This checklist covers what to secure on a WordPress or e-commerce website, how to tell whether your site has been hacked, and what to do if it has.
Why websites get hacked
- Outdated software. Vulnerabilities in WordPress plugins and themes are published constantly, and automated bots scan for sites that have not updated.
- Nulled themes and plugins. Pirated premium plugins are widely shared and frequently carry backdoors or hidden spam links.
- Weak or shared logins. One “admin” account with a simple password, shared between the owner, a developer and a marketer.
- Cheap shared hosting with no isolation, where one infected site can affect others on the same account.
- No backups, which turns a fixable incident into a rebuild.
The website security checklist
1. Hosting and accounts
- Register the domain and hosting in the company’s name and keep the login with an owner, not only the developer.
- Turn on registrar lock and MFA on the domain, hosting control panel and DNS (for example Cloudflare).
- Use hosting with isolated accounts, malware scanning and server-level backups.
- If you build or host systems for government bodies, check hosting location requirements: PISF 2026 expects government websites and apps hosted abroad to move to data centres in Pakistan.
2. HTTPS and security headers
- Serve every page over HTTPS with a valid certificate and redirect HTTP to HTTPS.
- Add HSTS, X-Content-Type-Options, X-Frame-Options or a frame-ancestors policy, and a referrer policy.
3. Updates
- Update WordPress core, themes and plugins at least weekly, after taking a backup.
- Delete plugins and themes you do not use; deactivated code can still be exploited.
- Replace any nulled plugin or theme with a licensed copy or a free alternative.
4. Login and user security
- Give every person their own account with the lowest role they need; avoid the username “admin”.
- Enforce strong passwords and two-factor authentication for administrators and shop managers.
- Limit login attempts and consider moving the default login URL to cut automated attacks.
- Remove developer and agency accounts when a project ends.
5. Firewall and malware scanning
- Put a web application firewall in front of the site, through a CDN or a security plugin, to block common attacks and bad bots.
- Run scheduled malware and file-integrity scans and get alerts by email.
6. Backups
- Take daily backups of files and database, keep at least one copy off the hosting account, and keep several days of history.
- Test a restore to a staging site every few months.
7. Hardening WordPress
- Disable the built-in theme and plugin file editor (DISALLOW_FILE_EDIT in wp-config.php).
- Set correct file permissions and block PHP execution in the uploads folder.
- Disable XML-RPC if you do not use it, and hide version numbers where possible.
8. Forms and spam
- Protect contact and quote forms with a CAPTCHA or honeypot and validate uploads.
- Do not ask for more personal data than you need, especially CNIC copies, and store submissions securely. Our guide to data protection law in Pakistan explains why.
9. E-commerce and payments
- Use a payment gateway’s hosted or redirect checkout so card details never touch your server, which keeps most of the PCI DSS burden with the provider.
- Never store card numbers, CVVs or wallet PINs in your database or order notes.
- Verify cash-on-delivery orders that look suspicious, and rate-limit checkout and coupon endpoints against bots.
- Restrict who can view customer data in the admin panel.
10. Email and domain reputation
- Publish SPF, DKIM and DMARC so attackers cannot easily send email that looks like it comes from your domain.
- Monitor whether your domain is blacklisted for spam or malware.
Signs your website has been hacked
- Google shows a “This site may be hacked” warning or Search Console reports a security issue.
- Search results show Japanese, pharma or casino pages you did not create.
- Visitors on mobile are redirected to other sites.
- New admin users, unknown files in uploads, or sudden spikes in server load or outgoing email.
What to do if your website is hacked
- Take a full backup of the infected site for evidence, then put it into maintenance mode.
- Change all passwords: hosting, database, WordPress users, FTP and email, and remove unknown users.
- Clean or restore from a known clean backup, then update everything that was outdated.
- Scan again, request a review in Google Search Console if a warning was shown, and monitor closely for a few weeks.
- If customer data or payments were involved, tell affected customers and, where it is a crime, report it to the National Cyber Crime Investigation Agency.
Website security is one part of a wider picture. For people, devices, email and backups across your business, see our cybersecurity checklist for small businesses. For clients who need formal assurance, ISO 27001 certification covers web applications as part of a full ISMS.
Frequently asked questions
How can I make my WordPress website secure?
Keep core, themes and plugins updated, remove unused or nulled plugins, use unique accounts with two-factor authentication, add a web application firewall, run malware scans and keep daily offsite backups.
How do I know if my website has been hacked?
Warning signs include a Google security warning, spam pages in search results, redirects on mobile, unknown admin users or files, and unusual server load or outgoing email.
Are nulled WordPress themes and plugins safe?
No. Nulled themes and plugins cannot receive official updates and often contain backdoors, malware or hidden spam links. Use licensed or free alternatives instead.
Does an online store in Pakistan need PCI DSS compliance?
Any business that accepts card payments falls under PCI DSS through its acquirer. Using a gateway hosted or redirect checkout, so card data never touches your server, keeps most of the burden with the payment provider.
How often should website backups be taken?
Daily for most business and e-commerce sites, with at least one copy stored away from the hosting account and a restore tested every few months.
How CEC can help
Connect Engineers & Consultants builds and maintains secure sites: business website development, e-commerce development with secure local payment integrations, and ongoing maintenance with updates, backups and monitoring. Read more in our WordPress development guide and why maintenance matters.
Worried about your site? Ask our team for a website security check.
This checklist is general guidance. No setup is completely secure, so combine these controls with regular reviews and professional help after any incident.
