Website Security for Small Businesses: 12 Essential Steps

On this page 14 sections

1. 011. Use HTTPS everywhere
2. 022. Keep everything updated
3. 033. Remove what you don’t use
4. 044. Strong passwords and a password manager
5. 055. Turn on two-factor authentication (2FA)
6. 066. Limit admin access
7. 077. Protect the login page
8. 088. Automatic off-site backups
9. 099. Choose secure hosting
10. 1010. Add a web application firewall (WAF)
11. 1111. Secure your forms
12. 1212. Monitor and log
13. 13What to do if your website is hacked
14. 14Frequently asked questions

Short answer: To protect a small business website: use HTTPS, keep software and plugins updated, use strong unique passwords with two-factor authentication, take automatic off-site backups, choose secure hosting, limit who has admin access, add a firewall, and monitor for problems. Most hacks exploit outdated software and weak passwords, not clever attacks.

Small businesses often think “nobody would hack us”. But most attacks are automated bots scanning millions of sites for known weaknesses. Size doesn’t matter; vulnerability does.

1. Use HTTPS everywhere

An SSL/TLS certificate encrypts data between visitors and your site and shows the padlock. Most hosts offer free certificates. Redirect every page to HTTPS.

2. Keep everything updated

Outdated CMS cores, themes and plugins are the number one way sites get hacked. Turn on automatic updates for security releases and check the rest weekly.

3. Remove what you don’t use

Every unused plugin, theme or old staging copy is an extra door. Delete them, don’t just deactivate them.

4. Strong passwords and a password manager

Long, unique passwords for hosting, domain, CMS and email. A password manager makes this painless.

5. Turn on two-factor authentication (2FA)

On your website admin, hosting account, domain registrar and email. Even a stolen password then isn’t enough.

6. Limit admin access

Give each person their own account with the lowest role they need. Remove ex-employees and old freelancers immediately.

7. Protect the login page

Limit login attempts, add 2FA and consider a custom login URL. For WordPress I built Secure Custom Login for exactly this.

8. Automatic off-site backups

Daily backups stored somewhere other than your server, with at least a few weeks of history. Test restoring one. A backup you can’t restore is not a backup.

9. Choose secure hosting

Look for isolated accounts, malware scanning, automatic SSL, server-level firewalls and support that responds. Cheap overcrowded hosting is a risk.

10. Add a web application firewall (WAF)

A WAF blocks common attacks and bad bots before they reach your site. Services at the DNS level or security plugins can provide one.

11. Secure your forms

Validate and sanitise input, add spam protection and never email passwords or sensitive data in plain text.

12. Monitor and log

Uptime monitoring, malware scans and login alerts tell you about problems before customers do. Set security headers like HSTS and a Content Security Policy.

What to do if your website is hacked

1. Don’t panic, and don’t delete everything
2. Change all passwords (hosting, CMS, database, email, FTP)
3. Contact your host. They may help clean or restore
4. Restore a clean backup from before the hack
5. Update everything and remove unknown users and files
6. Find how they got in and close that hole
7. Request a review in Google Search Console if Google flagged your site

If you run WordPress, also read my WordPress security guide.

Frequently asked questions

Do small business websites really get hacked?

Yes. Automated bots target any site with known weaknesses, regardless of size. Small sites are often easier targets because they are less maintained.

Is a free SSL certificate secure?

Yes. Free certificates provide the same encryption as paid ones. Paid certificates add extra validation or warranties some businesses want.

How often should I back up my website?

Daily for sites that change often, like stores or blogs. Weekly can be fine for small brochure sites. Keep copies off the server.

Can you secure my website?

Yes. Security, backups and updates can be part of ongoing maintenance, priced around what your site needs. Get in touch.