Website security basics for small businesses: a practical checklist

Most attacks on small-business websites are not personal. Automated programs scan the web around the clock, looking for old software, weak passwords and forgotten plugins, and they break into whatever is easiest. The good news is that a handful of sensible habits block most of them. This guide covers those habits in plain language, and what to do if the worst happens.

1. Use HTTPS on every page

HTTPS encrypts the connection between your visitor's browser and your website, so contact forms, logins and payments can't be read on the way. It shows as a padlock in the address bar. Browsers label sites without it as "Not secure", which puts customers off, and Google has said HTTPS is a factor in search.

• Get a certificate. Most hosts include a free one, and platforms such as Wix and Shopify turn it on automatically.
• Make sure every address redirects to the HTTPS version, including the version without "www".
• Check that the certificate renews automatically, and fix any "mixed content" warnings caused by images or scripts still loading over plain HTTP.

Google's web.dev guide to HTTPS explains the reasons in more detail.

2. Keep everything updated

Updates fix security holes that attackers already know about. Once a fix is published, the hole is public, and unpatched sites become easy targets. On a self-hosted site, that means:

• The core software, such as WordPress.
• Every theme and plugin, including inactive ones.
• The server's PHP version, which your host can update.

Turn on automatic updates for minor and security releases. For larger updates, take a backup first and check the site afterwards. Hosted platforms like Wix and Shopify update themselves, which is one of their real advantages, but you still need to look after apps and accounts. Our WordPress care service handles updates if you would rather not.

Be careful with plugins and themes

Every plugin is extra code that can contain a weakness. Before installing one, check that it is actively maintained, recently updated and widely used, and that it comes from the official directory or a reputable developer. Never install "nulled" or pirated premium themes and plugins: they are a well-known way of slipping malware onto sites. Delete anything you no longer use rather than just deactivating it.

3. Strong passwords and 2-step sign-in

Stolen and guessed passwords are among the commonest ways in. Protect every account that can change your website: the site admin, your hosting, your domain registrar and the email address those accounts use for password resets.

1. Use a password manager to create a long, unique password for each account. Never reuse a password from another service.
2. Turn on 2-step verification everywhere it is offered, preferably with an authenticator app rather than SMS. A stolen password alone is then not enough.
3. Give each person their own login instead of a shared admin account, with only the access they need. An editor writing blog posts doesn't need to install plugins.
4. Remove accounts for former staff and agencies as soon as they leave.
5. Change default usernames such as "admin".

4. Take backups you can actually restore

A backup is your way back from a hack, a broken update or an accidental deletion. A good backup routine is:

• Automatic: daily for sites that change often, weekly for those that don't.
• Complete: both the files and the database.
• Stored elsewhere: not only on the same server, which may be the thing that fails. Cloud storage in a separate account works well.
• Kept for a while: several weeks of copies, because a hack is sometimes found days after it happened.
• Tested: restore a copy to a test site now and then. A backup you have never restored is a hope, not a plan.

5. Protect your forms from spam

Contact and sign-up forms attract bots that send spam, fill your inbox and sometimes try to inject harmful code. Layered protection works best:

• A hidden "honeypot" field that real people never see but bots fill in.
• A bot check such as Google reCAPTCHA or Cloudflare Turnstile, ideally an invisible one that doesn't annoy customers.
• Limits on how many times one address can submit in a short period.
• Server-side checks on every field, so the form accepts only what it should.

Also make sure the form's emails go to an inbox someone actually reads. A form that loses real enquiries is a problem too.

6. A few more sensible settings

• Choose a reputable host with server firewalls, malware scanning and support you can reach.
• Consider a web application firewall, offered by many hosts and services such as Cloudflare, to block common attacks before they reach your site.
• Lock your domain at the registrar and keep its renewal on auto-pay. An expired domain can be taken over.
• Collect only the personal data you need, and don't store card details on your own site; let your payment provider handle them.
• Add your site to Google Search Console, which emails you if Google detects malware or hacked content.

What to do if your site is hacked

Signs include strange pages in Google results, redirects to other sites, a "This site may be hacked" warning, new admin users you didn't create, or a message from your host. Stay calm and work through it:

1. Contact your host and tell them. They may be able to isolate the site and help find the cause.
2. Change every password: website admins, hosting, database, FTP and email. Turn on 2-step verification if it wasn't on.
3. Find out how they got in, often an old plugin or a stolen password, and close that hole. Otherwise they will return.
4. Clean or restore. Restore from a backup taken before the hack, then update everything at once. If there is no clean backup, get a professional to clean the files and database.
5. Check Google Search Console's Security Issues report, fix what it lists and request a review. Google's security documentation explains the steps.
6. Tell affected people if customer data may have been exposed, and check your legal duties. In India, CERT-In is the national agency for reporting cyber security incidents; the USA and Vietnam have their own authorities and rules.

Then put the habits above in place so it doesn't happen again.

A free website check can flag basics such as missing HTTPS or an outdated setup. If you'd like someone to handle updates, backups and monitoring for you, ToBrand can help; get in touch and tell us about your site.