As someone who owns a company that makes and ranks websites for clients and does it for funsies b/c he’s a nerd, I know firsthand how important it is to build websites to be SEO’d and secure.
But most people have no idea how important website security is to SEO rankings.
It’s not just protection from hackers and other threats, a secure website (in all its forms) is 100% a ranking factor for Google.
Understanding Website Security
Website security refers to the processes and practices that protect a website from cyber threats such as hacking, malware, phishing, and spam. These threats can compromise your website's integrity and expose your users' sensitive information.
Common website security threats include:
- Malware: Software designed to damage, disrupt, or gain unauthorized access to a computer system.
- Phishing: An attempt to acquire sensitive information by posing as a trustworthy entity.
- SQL Injection: A type of cyber attack that targets databases to access or manipulate data.
- Cross-site scripting (XSS): A type of attack that injects malicious code into a website to steal information or execute actions on behalf of the user.
- Keyloggers: Malicious software that logs keypresses and sends the data to a 3rd party. Commonly used to get access to credit card information as a user types it into a form.
- Bots: Outside programs that browse and take actions on your website - even though it’s a robot. Commonly used to submit forms en mass (spam).
There are many ways to protect your website from these things so that your website’s SEO isn’t impacted.
SEO and Website Security Best Practices
We work mostly with Wordpress, so here are our recommendations relating to that but also a few that are general and should be applied to all websites.
The Importance of HTTPS
HTTPS (HyperText Transfer Protocol Secure) is an essential security protocol that encrypts data transmitted between a user's browser and a website. Google has stated that HTTPS is a ranking signal, meaning that websites that use HTTPS have a better chance of ranking higher on search engine results pages (SERPs) than websites that don't.
You’ll know if your website has this if the URL starts with https:// and/or you see the lock symbol next to it in the URL bar.
Most hosting companies provide an SSL for free using Let’s Encrypt. If yours does not, you’ll need to purchase one and install it. However, if your hosting company doesn’t provide one and forces you to buy one, that probably means you’re on a bad host and might want to consider switching.
Choosing a Secure Web Hosting Provider
Your choice of web hosting provider can also affect your website security and SEO (for many reasons, not just security).
When choosing a web hosting provider, look for this stuff:
- Regular security updates and patches
- Automatic backups
- Malware and spam protection
- DDoS protection
Updating Website Software
Keeping your website software up to date is an essential website security best practice and that’s why we offer website maintenance as a service for our clients. Outdated software can have security vulnerabilities that can be exploited by hackers. Make sure to update your website software, including your content management system (CMS), plugins, and themes, as soon as new updates become available.
This is especially important for Wordpress and why we stress that all clients should have us regularly update their websites. Wordpress powers most of the internet, which is great, but that makes it a huge target. ANY vulnerabilities that are left unpatched will be exploited and that’s why you want to make sure everything is up to date.
Using Strong Passwords
This one is a no-brainer. Always use strong passwords that are difficult to guess and include a mix of letters, numbers, and symbols. And for sure avoid using the same password across multiple accounts.
Implementing Two-Factor Authentication
Two-factor authentication (2FA) is an extra layer of security that requires users to provide two forms of identification to access their accounts. It’s when you go to login somewhere and it asks for a code from your phone or email.
For Wordpress, one way to get this and other security is to use the Wordfence plugin. It’s free and this feature is included. We require all e-commerce sites on Woocommerce to have this enabled for administrators. We had a client get phished and a simple 2step login would have prevented it.
Protecting Against Spam and Malware
To protect your website against spam, you can use tools such as Akismet, which is a popular WordPress plugin that filters spam comments. You can also use reCAPTCHA, which is a free Google service that helps prevent spam and abuse by requiring users to solve a CAPTCHA puzzle. ReCaptcha is built into most contact form plugins and all you have to do is set it up.
To protect your website against malware, you can use malware scanners such as Sucuri or Wordfence, both provide website monitoring, firewalls, and malware removal.
The last thing we might suggest is Cloudflare. Cloudflare can do a lot (similar to Wordfence and Sucuri) but does it in a different (usually better) way.
You’ll want some combination of these tools to help protect your website’s reputation.
The Consequences of Poor Website Security
Poor website security can have severe consequences on your website's SEO rankings and user experience. Here are some ways that poor website security can impact your website:
Security breaches can negatively affect your website's search engine rankings:
Google considers website security as a ranking factor. If your website gets hacked or compromised, it can negatively affect your website's search engine rankings and organic traffic.
Malware and spam can affect your website's performance:
Malware and spam can slow down your website's performance and affect user experience. Slow loading times can also negatively impact your website's search engine rankings.
Balancing Website Security and User Experience
Website security should not come at the expense of user experience. Here are some rules we use to make websites that are BOTH secure and SEO optimized:
User experience is an essential ranking factor for Google. A website that provides a great user experience is more likely to rank higher on search engine results pages than a website that provides a poor user experience.
That said, website security measures, like CAPTCHAs, can be frustrating for users. On top of that, Wordfence and any other security software can cause slow loading times, which can negatively impact user experience.
We combat and balance this by using caching, CDNs, a properly coded theme, and other “secret” best-practices. Specifically, we use WP Rocket, LiteSpeed, Cloudflare, and our own custom-coded theme built from the ground up.
FAQs
How do I know if my website has been hacked?
It can be hard to tell sometimes. The best way is to check your site for changes or other things that you didn’t do. You can use Wordfence to scan your Wordpress website. You can also wait for Google to tell you. They may notify you via Search Console or you’ll see it in the search results where it says “This website might be hacked”.
Can I improve my website's security without affecting SEO?
Yes, you can improve your website's security without affecting SEO. Follow website security best practices such as using strong passwords, updating website software, and conducting regular security audits like I listed above in the article.
How often should I conduct security audits for my website?
I would say every few months. They don’t need to be a full in-depth audit if your website is informational. If you website handles sensitive info, then you should do it more often and to a higher fidelity.
Will implementing website security measures negatively affect website performance?
Some website security measures such as firewalls and malware scanners can negatively impact website performance. But, there are ways make up for it like using caching plugins and CDNs.
How can I recover from a security breach and minimize its impact on SEO?
If your website has been hacked or compromised, you should take immediate action to remove the security threat and recover your website. You can minimize the impact of a security breach on SEO by using tools such as Google Search Console to monitor your website's search engine rankings and submit a reconsideration request after fixing the security issue.
