Website security basics for small businesses
Most website attacks are automated and opportunistic. These basics protect your site, your customers and your reputation.
- Published
- Reading time
- 1 min read
Key takeaways
- Keep software updated and remove plugins and accounts you don't use.
- Use strong unique passwords and two-factor authentication for every admin account.
- Keep tested backups, so an incident is an inconvenience, not a disaster.
Small business websites are rarely attacked because someone chose them. They are found by automated tools scanning the internet for outdated software, weak passwords and misconfigurations. The good news is that a few basic habits block most of these attacks.
Keep everything updated
Content management systems, themes, plugins and code libraries publish security fixes regularly. Apply updates promptly, after testing on a staging copy for important sites. Remove plugins, themes and integrations you no longer use; they still count as code that can be exploited.
Protect admin access
- Use a unique, long password for every account, stored in a password manager.
- Turn on two-factor authentication for the CMS, hosting, domain registrar and email.
- Give each person their own account with only the access they need, and remove accounts when people leave.
Use HTTPS everywhere
An SSL/TLS certificate encrypts traffic between visitors and your site. Most hosts provide free certificates. Make sure every page redirects to HTTPS.
Back up, and test the backups
Automatic daily backups stored separately from your hosting let you recover from attacks, mistakes and failed updates. Occasionally restore a backup to make sure it works.
Secure your forms
Forms are a common entry point for spam and abuse. Use bot protection, validate input on the server, limit uploads to the file types you need and avoid emailing sensitive data in plain text.
Collect only the data you need
Every piece of personal data you store is a responsibility. Keep forms short, delete data you no longer need and follow the privacy rules that apply to your customers.
Watch for problems
Uptime monitoring, security alerts from your host and regular checks of Search Console help you notice issues quickly.
Have a plan
Write down who to contact and what to do if the site is compromised: hosting support, your developer and where backups are kept.
Security is built into our website development work, from hosting choices to update routines after launch.
Frequently asked questions
Is my small website really a target?
Yes. Most attacks are automated scans looking for known weaknesses on any site, regardless of size.
What should I do if my site is hacked?
Take it offline or into maintenance mode if needed, change all passwords, restore from a clean backup, apply updates and find how the attacker got in. Get professional help if customer data may be affected.
