Small business owners often assume nobody would bother attacking their website. In reality, most attacks are automated. Bots scan the internet for weak passwords and outdated software, and they do not care how big you are.
The good news is that a handful of basic habits prevent most common problems, and none of them require a security team. Here is what to focus on.
1. Protect your accounts first
Your website is only as safe as the accounts that control it. That includes your hosting, domain registrar, DNS provider, content system, and the email address behind them.
- Turn on two-factor authentication everywhere, preferably with an authenticator app or a security key rather than text messages.
- Use a password manager so every account has a long, unique password.
- Protect your email account above all, because password resets go there. If someone controls your inbox, they can often take over everything else.
- Save your backup codes somewhere safe and separate.
- Remove old users. Former staff, agencies, and freelancers should not keep access.
2. Keep software up to date
Outdated software is one of the most common ways in. If you use a CMS such as WordPress, update the core system, themes, and plugins regularly, and delete the ones you no longer use. Fewer plugins means fewer things to patch.
A static website avoids much of this, because no server-side software runs for visitors. Static site or CMS?
3. Use HTTPS everywhere
Your whole site should load over a secure connection, with visitors automatically redirected from HTTP. Most modern hosts provide free certificates that renew automatically. Check that the certificate is renewing and that no pages show security warnings.
4. Have backups you have actually tested
- Back up your content, database, and files automatically.
- Keep at least one copy somewhere separate from your hosting account.
- Try restoring from a backup at least once. A backup you have never tested may not work when you need it.
If your site's source is kept in a private version control repository, you also get a full history of every change.
5. Protect your domain
Losing control of your domain can take down your website and email together.
- Turn on auto-renewal, and keep a working payment method on file.
- Enable registrar lock and two-factor authentication.
- Make sure the domain is registered in the company's name, on an account you control, not a former employee's or agency's.
6. Protect forms and data
- Collect only the information you need.
- Use spam protection on contact forms.
- Never put API keys or passwords in your website's code or public repositories.
- Know what personal data you hold, and follow the privacy rules that apply to you.
7. Add a protective layer
A content delivery network or web application firewall can filter a lot of bad traffic and absorb attacks, and many providers offer useful free plans. Basic security headers add further protection in the browser.
8. Know what to do if something goes wrong
Write a short plan before you need it:
- Who do you call: your host, developer, or agency?
- How do you take the site offline or restore a backup?
- Which passwords need changing?
- Who needs to be told? If personal data may be involved, get advice on your legal obligations.
A quick monthly check
- Are all updates installed?
- Did the latest backup run?
- Are there any unknown users on your accounts?
- Is the site loading over HTTPS with no warnings?
- Are domain and certificate renewals on track?
The bottom line
Good website security is mostly good habits: strong accounts, updated software, tested backups, and a safe domain. A little regular attention prevents most of the problems small businesses run into.
If you want a simpler, more secure website, or a review of your current setup, see our digital experiences service or email us.
