Website Security Basics for Small Businesses

Small business websites do get compromised, but almost never by someone targeting your business specifically. The realistic threat is automated: software that scans large numbers of sites for a known, already-patched vulnerability and exploits whatever it finds.

That is good news, because defending against an automated scan is far easier than defending against a determined attacker. A short list of measures handles nearly all of it.

1. Serve everything over HTTPS

Certificates are free through Let's Encrypt and included by most hosts. There is no longer any reason to run a site on plain http.

Two things to check beyond simply having a certificate: that http requests redirect to https rather than both versions loading, and that the certificate renews automatically. An expired certificate shows visitors a full-page browser warning, which is worse for business than almost any other technical failure.

2. Keep the software updated — or do not run software that needs updating

This is the single largest factor. The overwhelming majority of compromised small business sites are running a content management system with known vulnerabilities in the core, a theme, or a plugin — vulnerabilities that were patched, sometimes years earlier.

If you run WordPress or similar, updates are not optional maintenance. Enable automatic updates for security releases at minimum, review the site after they apply, and remove every plugin you are not actively using. Each installed plugin is additional attack surface, and deactivated plugins still sit on the server.

The alternative is not running that software at all. A static site has no database to inject into, no admin login to brute force, and no plugin ecosystem to patch. This is a genuine security argument for how a small business site is built, not just a performance one — and it is part of why we build them that way.

3. Use a password manager and two-factor authentication

Reused passwords are how most account compromises actually happen. A password leaked from an unrelated service gets tried against your hosting account, your domain registrar, and your CMS admin.

The minimum standard:

• A unique, generated password for every account, stored in a password manager
• Two-factor authentication on your domain registrar, your host, your CMS, and the email account that can reset all of them
• No shared logins — separate accounts for each person, removed when they leave
• Admin access only for people who need it

Your email account is the master key to everything else. Secure it first.

4. Lock down the domain

Losing your domain is worse than losing your website, and it is more common than people think. The site can be rebuilt from a backup. A hijacked or lapsed domain can be extremely difficult to recover.

What to do: enable registrar lock, turn on auto-renew, enable two-factor on the registrar account, and make sure the contact email is one that a real person monitors — not an address belonging to a developer you worked with four years ago. Check who is listed as the registrant. If it is not your business, fix that now.

5. Have backups you have actually restored

An untested backup is a hope. At least once, deliberately restore one somewhere and confirm the result works.

Backups should be automatic, stored somewhere other than the server they came from, and retained long enough to be useful — if a compromise goes unnoticed for three weeks, a two-week retention window means every backup contains the problem.

Nobody is targeting your business specifically. They are scanning everyone for the same handful of unpatched holes, and the fix is to not have those holes.

6. Protect the forms

Any public form will be found by spam bots. Beyond the nuisance, a badly built form can be abused to relay mail or inject content.

Reasonable measures: server-side validation of everything (client-side validation is a convenience, not a control), a honeypot field or rate limiting rather than a CAPTCHA where possible, and never trusting submitted input in emails or database queries without escaping it.

If a form collects anything personal, make sure it is transmitted over HTTPS, stored no longer than you need it, and covered by your privacy policy.

7. Reduce what you collect

The most reliable way to avoid losing customer data is to not hold it. Most small business sites do not need accounts, stored payment details, or a customer database. If you do not need it, do not collect it — every field you store is something you are now responsible for protecting.

Where you do need to take payments, use an established payment processor and let them handle card data rather than touching it yourself.

What you can reasonably skip

Expensive security suites for a brochure site. A static five-page site with no login and no database does not need a $30-a-month security subscription. Most of what those products defend against does not apply.

Trust seal badges. The "secure site" graphics sold as add-ons are decoration. They do not make anything more secure and experienced visitors know it.

Obscurity measures. Renaming the admin URL or hiding your CMS version slows an automated scan down by seconds. Patch instead.

If something does go wrong

Signs of compromise: unfamiliar pages appearing in a site:yourdomain.com search, browser or Search Console warnings, redirects to unrelated sites, unexpected admin accounts, or a sudden drop in traffic.

If it happens: take the site offline or into maintenance mode, change every password from a clean device, restore from a backup predating the compromise, patch whatever allowed it before going live again, and request a review in Search Console if Google flagged the site. Restoring without patching simply reproduces the problem.

The short version

HTTPS with auto-renewal, current software or no software to update, unique passwords with two-factor, a locked domain, and tested backups. That combination handles nearly every realistic threat to a small business website. Most of it is ordinary maintenance rather than a separate security budget.