Website Security Checklist for a Small Business

What website security includes

Security is a set of habits, not one product. Work through these checks, and find out who is responsible for each of them.

Website security means protecting your site, its logins and your visitors' data, and being able to recover if something goes wrong. An SSL certificate, which gives you HTTPS, only encrypts the connection and does not stop a site being hacked. A basic checklist covers unique logins with two-step verification, updates, trusted extensions, tested backups, safe forms and payments, and a plan for a hack.

Website security is the set of measures that keep your site, its logins and your visitors' data out of the wrong hands, and that let you recover quickly if something goes wrong. A website security checklist helps because the risks sit in several places at once, and the site's own code is only one of them.

The table shows the main areas, the usual risk in each and who normally looks after it. Who does what changes from one business to another, so confirm each line in writing with your developer and host.

Is an SSL certificate enough?

No. An SSL certificate, which today usually means a TLS certificate, puts https at the start of your address. It encrypts the connection between a visitor's browser and your server and helps confirm that the visitor has reached the right site. That is worth having, and browsers warn visitors when it is missing or has expired.

What it does not do is protect the site itself. A site with a padlock can still run old software, use a weak admin password or accept malicious uploads, and a hacked site can have a perfectly valid certificate. Treat HTTPS as the first item on the list and not the whole list. Check that every page loads over HTTPS without warnings and that the certificate renews on time. A technical SEO audit, described in the guide to signs your website needs one, also looks at whether HTTPS is used everywhere.

Website security checklist: logins and access

Most small-business break-ins start with a login, not with clever code. Work through this list.

• Give every account its own long, unique password, ideally kept in a password manager. Do not reuse the password from your email or any other site.
• Turn on two-step verification for the site admin, hosting, domain registrar, email and Google accounts wherever it is offered.
• Remove accounts for former staff, freelancers and agencies on the day they leave.
• Give each person the lowest role that lets them do the job. An editor does not need administrator rights.
• Do not share one administrator login between people. Separate accounts show who did what.
• Never send passwords by email or chat. Use a password manager's sharing feature or a one-time reset link.
• Keep your own login to the domain registrar and the hosting. If a developer holds the only login, you cannot act when something goes wrong.

Email deserves special care. Password reset links go to your inbox, so whoever controls your email can often take over everything else.

Software, plugins and themes

A site on a content management system runs on layers: the core software, the theme, the plugins or extensions and the server's own software. Weaknesses in old versions are published, so out-of-date software is an easy way in. The routine is covered in the guide to what website maintenance includes. These are the security points.

• Apply updates promptly. If the site takes orders or bookings, have someone try important updates on a copy first.
• Delete themes and plugins you do not use. Deactivating is not enough, since unused code can still contain a weakness.
• Install extensions only from the platform's own directory or the maker's site, and check that they are still maintained. Pirated copies of paid themes are a known way to install hidden malicious code.
• Keep a list of what is installed, with versions, so you know what to check when a weakness is announced.
• Replace anything its maker no longer updates.

A site built as plain pages, or on a hosted website builder, has fewer parts for you to update. Ask which parts the provider updates and which stay with you.

Hosting, backups and recovery

The host sets the base. Ask what it does about server updates, separation between customers' sites, malware scanning and backups, and whether those are included or optional. Modest hosting is not wrong in itself, but find out what you are getting.

A backup is only useful if it can be restored. Keep copies away from the server that holds the site, so that a break-in or a failed server does not take both. Include the files and the database. Try a restore on a copy now and then, and note the date. A backup nobody has tried to restore is a hope, not a plan.

Forms, uploads and payments

• Protect forms against spam and injected code. A developer can add checks, and forms from a plugin or builder need the same updates as everything else.
• Allow file uploads only where they are needed, limit the file types and keep uploaded files away from places where they can run.
• Do not store card details on your own site. Use a payment gateway's hosted page or components, so card data goes to the gateway and not through your server.
• Collect only the personal data you need, keep it only as long as you need it and explain your use of it in a privacy policy.
• Rules on personal data, and on telling people after a breach, differ by country. Ask your adviser or the official authority what applies to you.

Third-party scripts and embedded tools

Every chat widget, tracking tag, booking tool, map or embedded form loads code from another company. If one of them is compromised or abandoned, your site is affected. Remove tools you no longer use, check who is allowed to add tags in your tag manager, and prefer well-maintained tools from known providers. Each addition also slows the page, so fewer is better for both security and speed.

Your domain name and email

A domain that lapses, or is transferred away without your knowledge, takes the website and the email down together. Keep the registrar account in your business's name with two-step verification, switch on auto-renewal where it is offered, put the expiry date in a calendar and use any lock the registrar provides against unauthorised transfers. Check which email address is on file, because renewal and recovery messages go there.

How to tell if your site has been hacked

The signs vary, and some hacks are quiet. Look for these.

• Visitors are sent to another site, or pop-ups appear that you did not add.
• Pages, links or text you did not write appear, sometimes about unrelated products. Searching Google for site:yourdomain.com can show them.
• Your browser or Google shows a warning when you open the site or a search result.
• Unfamiliar administrator users appear, or you are locked out of your own login.
• The host suspends the site or reports unusual files or traffic.
• Contact form messages stop arriving, or go to an address you did not set.
• The site becomes slow for no clear reason.

Google Search Console has a Security issues report. Google says it shows its findings when an evaluation decides that a site was hacked or behaves in a way that could harm a visitor, such as phishing or installing malware. Affected pages can appear in search with a warning label, or with a warning page in the browser. Check the report now and then, and make sure the account's email address is one you read. It is a useful backstop and not a substitute for looking at your own site.

What to do if your site is hacked

1. Note what you see. Take screenshots and write down the time. Do not delete anything yet, because it may show how the attacker got in.
2. Contact your host and your developer straight away. Many hosts can isolate the site and tell you what they found.
3. If the site is sending visitors to harmful pages, put it into maintenance mode or take it offline until it is clean.
4. Change the passwords for the site admin, hosting, database, file transfer, domain registrar and email, using a device you trust. Turn on two-step verification.
5. Find out how the attacker got in. Typical answers are an old plugin, a stolen password or a weak hosting account. Closing that route matters, because otherwise the site is likely to be infected again.
6. Restore from a backup made before the problem, or clean the files. Update everything and remove unknown users and files.
7. If Google has flagged the site, fix every page affected, then use Request Review in the Security issues report and describe what you fixed. Google says fixing only some pages does not earn a partial return to search results, and that reviews can take from several days to a few weeks.
8. If customer data may have been exposed, ask a lawyer or the official authority in your country what you must report, and to whom.

Cleaning a hacked site takes the skill to read code and server settings. Google's own help says that fixing malware requires this ability and suggests finding someone to help if it is beyond your comfort zone. Hiring a professional is reasonable.

Who is responsible for website security, you or your developer?

Both, for different parts. Your developer or provider is usually responsible for the build, the updates and the technical settings you agree in writing. You are responsible for your own accounts, the people you give access to, the content you add and the decisions about what to spend on hosting and maintenance. The host is responsible for the servers it runs.

Gaps appear when each side assumes the other has it covered. Put these questions to your developer or provider.

• Which security tasks are included in what I pay, and which are not?
• Who updates the system, theme and plugins, and how often?
• Where are the backups kept, and when was a restore last tested?
• Who do I contact if the site is hacked, and what has been agreed about how quickly they respond?
• Who holds the logins for the domain, the hosting and the site admin?

The website development service page describes the build work Liftup does. Whichever team you choose, ask these questions before you sign.

How often to review your website security

Questions and answers

What does website security include?

It includes protecting logins, keeping software and plugins updated, choosing a host with sensible protections, using HTTPS, checking forms and payments, managing your domain and email, keeping tested backups and having a plan for a hack. It spans several people, and your developer is only one of them.

Is an SSL certificate enough to keep a website secure?

No. An SSL certificate encrypts the connection between visitor and site, which is important, but it does not stop a site being hacked through weak passwords or out-of-date software. A hacked site can still show a padlock. Treat HTTPS as one item among many.

How do I know if my site has been hacked?

Look for redirects to other sites, pages or links you did not add, browser or Google warnings, unknown administrator users, a suspended account, missing form messages and unexplained slowness. Google Search Console also has a Security issues report that shows Google's findings.

What is a website security audit, and do I need one?

A website security audit is a structured review of the points on this checklist: accounts and access, software versions, hosting and backups, forms, third-party tools and monitoring. A small business can make a first pass itself, then ask a developer or specialist to review what it cannot judge, such as server settings and code.

What should I do if my site is hacked?

Take screenshots, contact your host and developer, take the site offline if it is harming visitors, and change all related passwords. Then find the way in, restore a clean backup, update everything and remove unknown users. If Google flagged the site, request a review once every page is fixed.

Who is responsible for security, me or my developer?

Both. Your developer or provider usually handles the build, updates and technical settings you have agreed, and the host looks after its servers. You look after your accounts, who has access and what you add. Ask in writing which tasks are included.