Therapist Website Security Checklist

Last updated: October 28, 2026 · By Alex Sandev, Founder of HiveSourced

A secure therapist website keeps WordPress, themes and plugins updated, backs up files and the database on a schedule, runs over HTTPS, protects every login with a strong unique password and two-step verification, and sends contact form messages through a setup built for sensitive information. This checklist walks through each item so you can check your own site in about thirty minutes.

Why does website security matter for a therapy practice?

Clients send you sensitive details through your contact form, and your site carries your name and license. A hacked or broken site can leak messages, show spam to visitors or disappear from Google. Most problems on WordPress sites come from old software and weak logins, which are both fixable. The checklist below follows the WordPress.org hardening guide.

What should be on a therapist website security checklist?

Item	What to do	How often
WordPress, theme and plugin updates	Install updates, or turn on automatic updates where it is safe	Weekly check
Backups	Keep copies of your files and database in a separate trusted location	Daily or weekly, plus a restore test twice a year
HTTPS	Make sure the whole site, and the admin login, loads over HTTPS	Check after any hosting change
Logins	Strong unique password and two-step verification for every admin	Review each quarter
Plugins and themes	Remove any you do not use and install only from trusted sources	Review each quarter
Contact form	Use a form and email setup built for sensitive information	Review each year

How do you keep WordPress, themes and plugins updated?

The WordPress.org guide says to run the latest version of WordPress and to consider automatic updates, because older versions no longer receive security fixes. The same applies to your theme and plugins. Each plugin you add is more code that needs updating, so delete the ones you do not use and install only from the WordPress.org repository or well-known companies.

Before a big update, take a backup. After it, open your homepage, your contact page and your booking page to make sure nothing broke. Do not ignore update notices for months. That is how small gaps become real ones.

How should you back up a therapist website?

A backup is a saved copy of your files and your database. WordPress.org advises regular snapshots kept in a trusted location, which means not only on the same server as the site. Pick a schedule that fits how often your site changes, keep more than one copy, and check that you can actually restore from one. A backup you have never tested is a guess.

Is HTTPS and SSL enough?

HTTPS encrypts the connection between a visitor and your site, and WordPress.org recommends using it for administration as well. Look for the padlock on every page and make sure the version without HTTPS redirects to the secure one. It protects data in transit. It does not protect you from a weak password or an out-of-date plugin, so treat it as one item on the list.

What makes a login secure?

CISA’s guidance on strong passwords is simple:

• Use at least 16 characters, either random or a passphrase of four to seven unrelated words.
• Use a different password for every account, including your website admin, hosting and email.
• Store them in a password manager so you only remember one master password.
• Turn on multifactor authentication, especially for email, which can reset your other accounts.

WordPress.org adds that you should avoid names, dictionary words and short passwords, and that you should enable two-step authentication. Give each person who edits the site their own login, and remove accounts for anyone who no longer works with you.

Is a secure website the same as a HIPAA-compliant one?

No. Securing WordPress protects your site. HIPAA concerns how your practice protects client health information, including in forms and email. The HHS Security Rule summary explains the safeguards, and your practice stays responsible for how it handles client information. Our guide to HIPAA-compliant emails and forms covers the practical options, and our post on Google Analytics and HIPAA covers tracking tools. This is general information, not legal advice.

When should you hand security off?

If you are not comfortable checking updates and backups yourself, you do not have to. Hosting and maintenance from HiveSourced covers plugin updates, daily backups, uptime monitoring and security patches. It is $20 per month for sites we built and $35 per month for sites built elsewhere. See our pricing page for everything else. If your site is old enough that patching it feels risky, a redesign may be the safer route.

What are the warning signs that a site has been compromised?

You do not need to be a developer to notice trouble. Watch for these signs and treat any of them as a reason to act the same day:

• Your site redirects to another website, or shows ads and pages you did not create.
• Google or your browser shows a warning when someone visits.
• You cannot log in, or you get password reset emails you did not request.
• New admin users appear that you do not recognize.
• Your contact form stops sending messages, or messages arrive with strange content.
• The site suddenly becomes very slow or goes offline without a hosting change.

Silence is not proof of safety, either. Some problems stay hidden for weeks, which is why scheduled updates and backups matter more than reacting after the fact.

What should you do if your therapy website is hacked?

1. Change the passwords for your website admin, hosting and the email account tied to the site, using a device you trust.
2. Contact your host or maintenance provider and ask them to take the site offline or into maintenance mode if client messages could be exposed.
3. Restore from a clean backup made before the problem started, then update everything before you bring the site back.
4. Remove unknown admin users and any plugins or themes you do not use.
5. Review what the contact form collected. If client information may have been exposed, check your obligations under HIPAA and your state rules with qualified advice, because breach notification rules can apply.

This is why a tested backup matters. Restoring a clean copy is far faster than cleaning a site by hand.

How can you run a 30-minute security check this week?

1. Log in and open the updates screen. Install pending updates for WordPress, your theme and your plugins.
2. Delete plugins and themes you do not use.
3. Open Users and remove anyone who should no longer have access. Give each person their own login.
4. Change any weak or reused password and turn on two-step verification.
5. Confirm your host takes backups, where they are stored and how to restore one.
6. Visit your site with and without the secure prefix and confirm the padlock shows on every page.
7. Send a test message through your contact form and make sure it arrives.

Put a repeat reminder in your calendar. Once a quarter is enough for most small practices, with a quick weekly look at updates.

Frequently asked questions