Website Security Basics for Small Businesses

Most website attacks aren't personal. Automated bots scan the web around the clock, looking for outdated software, weak passwords and vulnerable plugins. A small business site is just as likely to be hit as a large one, and often less prepared. The good news: a handful of basics block most of these attacks. Here's what every small business website needs.

1. Keep everything updated

Outdated software is one of the most common ways sites get compromised. Keep your CMS, theme, plugins and server software up to date, and remove anything you no longer use. Unused plugins can still be exploited.

2. Lock down logins

• Unique, strong passwords for every account, stored in a password manager
• Two-factor authentication on your website admin, hosting, domain registrar and email
• Individual accounts for each person; never share one admin login
• Least privilege: give people only the access they need
• Remove access promptly when someone leaves or a supplier's work ends

3. Back up, and test restoring

Backups turn a disaster into an inconvenience:

• Back up files and database regularly, daily for most business sites
• Store copies somewhere separate from your hosting
• Keep several versions, so you can go back before a problem started
• Test a restore occasionally; an untested backup is a hope, not a plan

4. Use HTTPS everywhere

An SSL/TLS certificate encrypts traffic between your visitors and your site. Most hosts provide free certificates. Redirect all HTTP traffic to HTTPS and fix any "mixed content" warnings.

5. Protect your forms

Contact and sign-up forms attract spam and abuse:

• Use spam protection such as a CAPTCHA or honeypot field
• Validate input on the server, not just in the browser
• Limit how often forms can be submitted
• Don't email sensitive data in plain text

6. Choose good hosting

Reputable hosting includes firewalls, malware scanning, isolated accounts and fast security patching. Very cheap shared hosting can put your site next to compromised neighbours.

7. Protect your domain and email

• Lock your domain at the registrar and enable two-factor authentication
• Keep registrar contact details current, so renewal notices reach you
• Set up SPF, DKIM and DMARC so criminals can't easily send email pretending to be you; see SPF, DKIM and DMARC explained

8. Handle customer data carefully

Collect only the personal data you need, keep it only as long as you need it, and know where it's stored. Data protection laws such as the UK GDPR set out your obligations.

9. Monitor

• Uptime monitoring alerts you when the site goes down
• Google Search Console warns you about security issues and malware it detects; see our Search Console guide
• Review admin accounts and installed plugins every few months

10. Have a plan for when things go wrong

Write down who to call, where backups are, how to take the site offline and how to restore it. A one-page plan saves hours of panic.

Extra steps for WordPress sites

WordPress powers a large share of the web, which makes it a common target:

• Keep core, themes and plugins updated, and enable automatic minor updates.
• Install plugins only from reputable sources, and remove unused ones completely.
• Limit login attempts and use two-factor authentication.
• Don't use "admin" as a username.
• Use a security plugin or host-level firewall.
• Disable file editing from the dashboard.
• Keep regular off-site backups.

Signs your site may have been hacked

• Google shows a "This site may be hacked" warning, or Search Console reports a security issue
• Unfamiliar pages, links or spam content appear in search results for your domain
• Visitors are redirected to other sites, especially on mobile
• Unknown admin users appear
• Your host suspends the site or warns about malware
• Emails from your domain start bouncing or landing in spam

If you're hacked: step by step

1. Don't panic, and don't delete everything. You'll need evidence to find how it happened.
2. Contact your host; many can scan and help clean up.
3. Change all passwords: hosting, admin, database, FTP and email.
4. Restore from a clean backup taken before the problem started, or have the site cleaned professionally.
5. Update everything and remove anything unused.
6. Find and fix the cause: an outdated plugin, a weak password, a leaked key.
7. Check Search Console and request a review if Google flagged the site.
8. Tell affected customers if personal data may have been exposed, and check your legal obligations.

A quarterly security checklist

Security is part of maintenance

Security isn't a one-off job; it's part of looking after a website. Our guide to how often you should update your website covers the wider maintenance routine, and our website handover checklist makes sure you own and control every account from day one. If you'd rather hand it over, Zelvorm's maintenance and support team handles updates, backups and monitoring for clients.

The short version

Keep software updated, use strong unique passwords with two-factor authentication, back up and test restoring, use HTTPS, protect forms, choose good hosting, secure your domain and email, handle data carefully, monitor and have a written plan.