Website security basics most small businesses get wrong

Small business sites rarely get attacked by someone who chose them. They get caught by automated scripts that scan the whole internet looking for known weaknesses. That is good news: you are not defending against a determined expert, you are avoiding being the easiest door on the street.

1. Keep everything updated

The overwhelming majority of hacked small business sites were running an out-of-date plugin, theme or CMS version with a publicly documented vulnerability. Automated scanners look for exactly these.

If you run WordPress, turn on automatic updates for security releases at minimum, and delete plugins you no longer use rather than leaving them deactivated. Deactivated is not the same as gone.

2. Use proper passwords and two-factor authentication

Every admin account should have a unique, long password stored in a password manager, plus two-factor authentication. Shared logins passed around a team are the thing we most often have to unpick when we take over a site.

Give people their own accounts with the lowest access level that lets them do their job. Your content editor does not need the ability to install plugins.

3. Get HTTPS right, everywhere

A certificate is table stakes now and free from most hosts. What people miss is the follow-through: make sure every http:// request redirects to https://, and that no images or scripts on the page still load over plain HTTP. Mixed content quietly breaks the padlock.

4. Have backups you have actually restored

An untested backup is a hope, not a plan. Backups should be automatic, stored somewhere separate from the site itself, and retained long enough that you can go back past the point where a problem started — some compromises sit unnoticed for weeks.

Restore one to a staging site once. The first time you discover your backup is incomplete should not be the day you need it.

5. Collect less data

The safest customer data is the data you never collected. Every extra field on your contact form is something you now have a duty to protect and, depending on where your customers are, a legal obligation around. Ask for what you need to reply, and no more.

Never store card details yourself. Use a payment provider that handles it, so that risk sits with a company built to carry it.

What this costs

Almost nothing, other than attention. Managed hosting with automatic updates, a password manager, and a backup service will run to a few pounds a month between them. Compare that with the cost of a week offline, or of telling your customers their details leaked.

If you think you have been compromised

Take the site offline or into maintenance mode, change every password from a clean device, restore from a backup that predates the problem, and only then work out how they got in. Restoring without closing the hole just resets the clock.