Small businesses often assume they are too small to be targeted. In practice, most website attacks are automated: bots scan millions of sites for known weaknesses and exploit whatever they find. The defences are not exotic. They are basics, done consistently.
The checklist
1. HTTPS everywhere
Every page should load over HTTPS with a valid certificate, and HTTP addresses should redirect to HTTPS. Browsers label non-HTTPS pages “Not secure”, which costs trust as well as safety.
2. Prompt updates
Platform, theme and plugin updates often contain security fixes. Apply them promptly, after a backup, and test the site afterwards. Abandoned plugins that no longer receive updates should be replaced.
3. Fewer plugins and accounts
Every plugin is code you have to trust and keep updated. Remove anything you no longer use. Do the same for user accounts: former staff and old contractors should not still have logins.
4. Strong logins
- A unique, long password for every account, stored in a password manager.
- Two-factor authentication on the website admin, hosting, domain registrar and email.
- Give each person their own login with only the access they need.
5. Backups you can actually restore
Automatic daily backups, kept off the main server, with several days of history. Test a restore at least once; a backup that does not restore is not a backup.
6. Protect forms
Use spam protection on contact forms, validate what visitors enter, and do not have forms email sensitive data such as card numbers or ID documents. Collect only the information you need.
7. Secure the domain and email
Your domain registrar account is a master key: if someone takes it over, they control your website and email. Lock the domain, turn on two-factor authentication and keep contact details current. Set up SPF, DKIM and DMARC records so others cannot easily send email pretending to be you.
8. Monitoring
Uptime monitoring, malware scanning and Google Search Console’s security issues report tell you about problems before customers do.
If the worst happens
- Put the site into maintenance mode.
- Change every password: website, hosting, registrar, email.
- Restore a clean backup from before the attack, then update everything.
- Find and fix how they got in, or it will happen again.
- Check Search Console for warnings and request a review once the site is clean.
Hosting, SSL, daily backups and security updates are part of every site in our $1,950-a-year package, so this checklist is handled for you. For the wider picture of keeping a site healthy, read what website maintenance includes.