Website security basics for small business sites

The short answer

Keep your website software updated, use unique strong passwords with two-step login, limit who has admin access, serve the site over HTTPS, remove what you do not use and keep tested backups. Add monitoring so you notice problems fast, and have a short plan for what to do if the site is compromised.

Why small sites get targeted

Attackers rarely pick a business by name. Automated programs scan huge numbers of sites looking for known weaknesses, such as an outdated plugin or a login page with a guessable password. A compromised site can be used to host spam, redirect visitors to scam pages or store malicious files, often without the owner noticing for weeks.

That is encouraging news in one way: the defences are mostly routine. You do not need an enormous budget to avoid being the easy target. You need a short list of good habits, done consistently.

Keep everything updated

Outdated software is among the most common ways in. This covers the content management system, themes, plugins and any libraries the site depends on. Updates often contain fixes for security flaws that have already been publicly described, which means attackers know exactly what to look for.

• Apply security updates promptly, not once a year.
• Test updates on a staging copy before applying them to a busy shop or booking site.
• Take a backup first, every time.
• Delete plugins and themes you do not use. Deactivating is not enough; unused code can still be exploited.
• Be selective about additions. Every extra plugin is more code to maintain; see how many plugins is too many.

Logins and access

Weak or reused passwords are another leading cause. When one service leaks its users' passwords, attackers try the same combinations everywhere.

1. Unique passwords. Use a password manager so each account has its own long password.
2. Two-step login. Turn on two-factor authentication for the website admin, hosting account, domain registrar and email. If your main email is taken over, attackers can reset everything else.
3. Least access. Give people only the permissions they need. A writer does not need to be an administrator.
4. Remove old users. When a freelancer or employee leaves, close their account the same day.
5. No shared logins. Named accounts show who did what.
6. Change the default admin address if your system has a well-known one, and limit repeated login attempts.

HTTPS and the trust signals visitors see

HTTPS encrypts traffic between the visitor and your site, and browsers show warnings on pages that do not use it, especially pages with forms. Most hosts offer certificates, and many do so at no extra charge; check your host's documentation. Make sure every page redirects to the HTTPS version and that images and scripts also load securely, otherwise visitors may see mixed-content warnings.

Remember that HTTPS protects the connection, not the site itself. A site can be encrypted and still be full of malware. For shops, security cues should be accurate: our guide to trust badges and security signals explains what to show and what not to claim.

Protect forms and uploads

Anything that accepts input from the public needs care. Forms can be abused for spam or injection attacks, and upload fields can be used to place harmful files on your server. Ask your developer to validate input on the server, limit file types and sizes, and keep uploads out of places where they could be run as code. For spam, see spam protection for website forms, and for the form itself contact form best practices.

Hosting, backups and monitoring

Your host is part of your security. Look for a provider that keeps its own server software updated, separates accounts from each other and offers a way to restore. Read how to choose web hosting before you decide.

Keep tested copies off-site, as explained in the website backup guide. Add uptime monitoring and turn on alerts from your search engine tools; Google Search Console, for example, can notify you about security issues it detects on your site. Check current documentation for what alerts are available.

A simple monthly security routine

Security works best as a short, repeated routine rather than a one-off project. Once a month, set aside a small block of time to do the following.

• Check for pending updates and apply them after a backup.
• Review the list of users and remove anyone who no longer needs access.
• Confirm that two-step login is still on for the main accounts.
• Look at recent login attempts or security notices from your host.
• Check that backups ran and note when you last tested a restore.
• Scan the site for pages or files you do not recognise.

Record what you checked and the date. If you outsource upkeep, ask for this list to be part of the report you receive.

If your site is compromised

Signs include unexpected pages, strange redirects, a browser warning, spam emails sent from your domain, or a host suspending your account. Stay calm and work through it in order.

1. Tell your developer and host straight away.
2. Change passwords for the website, hosting, domain and email, from a device you trust.
3. Take the site offline or into maintenance mode if visitors are at risk.
4. Restore from a clean backup taken before the problem, then update everything.
5. Find how they got in, or the same door will be used again.
6. If personal data may have been exposed, ask a qualified lawyer about any duty to notify people or authorities in the places you serve.

Our guide to what to do when your website goes down covers the wider incident steps. Write this plan before you need it, and fold the regular tasks into a maintenance plan.

Related guides

• Website development
• Website Backups: How Often and Where to Keep Them
• Website Maintenance Plan: What It Should Include
• Website security checklist for small business
• Retargeting explained for small business
• Youtube marketing basics for small business

Questions and answers

Is my small business website really at risk?

Yes. Most attacks are automated and target known weaknesses in any site, regardless of size. Updates, strong logins and backups reduce the risk considerably.

What is the single most useful security step?

Keeping software updated is a strong first step, closely followed by unique passwords with two-step login on your website, hosting, domain and email accounts.

Does HTTPS make my site secure?

It encrypts the connection between visitor and site, and browsers expect it. It does not protect against weak passwords, outdated software or malware on the server.

Do I need a security plugin?

It can help with login protection and scanning, but it does not replace updates, backups and good access control. Add only what you will maintain, and check that it is actively supported.

How do I know if my site has been hacked?

Look for unfamiliar pages, redirects, browser or search warnings, odd emails sent from your domain and sudden changes in performance. Monitoring and search engine alerts help you spot problems sooner.

Who should handle security: me, my host or my developer?

All three share it. The host secures the servers, your developer maintains the software and you control access and passwords. Agree in writing who does what in your maintenance arrangement.