Small Business Website Security: The Basics That Prevent Most Problems

Most small-business websites aren’t hacked by someone who targeted them personally. They’re found by automated bots scanning the internet for outdated software, weak passwords and forgotten plugins. If your site has one of those openings, it’s a target, no matter how small your business is.

The good news is that the basics prevent most of these problems. None of them require you to be technical, but they do require someone to actually do them.

Use HTTPS everywhere

HTTPS encrypts the connection between your visitor’s browser and your website. Without it, browsers show a “Not secure” warning, which is a quick way to lose a customer’s trust, especially on a contact or booking form.

Google also uses HTTPS as a lightweight ranking signal. It won’t lift a weak page to the top, but there’s no reason to go without it.

Check that:

• Your site loads with https:// and a padlock icon in the browser.
• Typing http:// redirects automatically to the https:// version.
• There are no “mixed content” warnings from images or scripts still loading over plain HTTP.
• Your SSL certificate renews automatically. Most hosts handle this, but confirm it.

SSL is one of the things worth asking about before you sign up with a host; our guide on how to choose web hosting covers the rest.

Keep everything updated

Outdated software is one of the most common ways sites get compromised. When a vulnerability in a popular plugin or theme becomes public, bots start scanning for sites that haven’t updated.

If you’re on WordPress, that means keeping these current:

• WordPress core
• Every plugin
• Your theme, and the parent theme if you use a child theme
• The PHP version on your hosting account, which your host usually manages from a control panel such as cPanel

Hosted platforms like Shopify, Squarespace and Wix handle core updates for you, but you’re still responsible for any third-party apps or extensions you add and for your own account security.

Task	Self-hosted WordPress	Hosted platform (Shopify, Squarespace, Wix)
Core software updates	You or your developer	The platform
Plugin, theme or app updates	You or your developer	You, for apps you add
Server security	Your host	The platform
SSL certificate	Usually your host, confirm it	The platform
Backups	Your host and/or a backup plugin	Check what the platform offers
Passwords, 2FA, staff access	You	You

Updates occasionally break things, so the safest routine is: back up first, update, then check the key pages and forms. On a business-critical site, test updates on a staging copy before applying them to the live site. Our website maintenance checklist puts this into a weekly routine.

Have backups you can actually restore

A backup is your undo button. If the site gets hacked, an update breaks something or someone deletes the wrong page, a good backup gets you back online.

A good backup setup:

• Runs automatically on a regular schedule, more often if your site changes often (an online store, for example).
• Includes both files and the database. On WordPress, a files-only backup misses your content.
• Is stored off the server. If your backups live on the same hosting account as the site, a hack or a hosting problem can take out both.
• Keeps several versions. Sometimes a hack goes unnoticed for a while, and you need to restore from before it happened.
• Has been tested. A backup you’ve never tried restoring is a guess, not a plan.

Ask your host or developer exactly what’s backed up, where it’s stored, how far back it goes and how a restore works. If you’re comparing options, our hosting and domains page explains what our own plans include.

Lock down logins

A stolen or guessed password gives an attacker the keys to your site. Protect every account that can change it: your website admin, hosting account, domain registrar and email.

• Use long, unique passwords for each account, stored in a password manager.
• Turn on two-factor authentication (2FA) wherever it’s offered. An authenticator app is generally safer than text-message codes.
• Give each person their own login. Don’t share one admin account among staff, your web designer and a marketing contractor. Separate accounts let you remove access cleanly when someone leaves.
• Use the lowest role that does the job. Someone who only writes blog posts doesn’t need full administrator rights.
• Remove old accounts for former staff and past contractors.
• Avoid “admin” as a username on WordPress. It’s the first name bots try.

Your domain registrar account deserves special attention. Whoever controls it controls where your website and email point. Make sure it’s in your business’s name, uses 2FA and has a current contact email you check. If someone else built your site, read our advice on ownership and access before you need it.

Practice plugin hygiene

On WordPress, plugins are a major source of security problems. Each one is code someone else wrote, running on your site.

• Install only what you need. Fewer plugins means fewer things to update and fewer potential openings.
• Delete, don’t just deactivate, plugins you’re not using. Deactivated plugins can still contain vulnerable files.
• Choose actively maintained plugins. Check when a plugin was last updated and whether the developer responds to support questions in the WordPress.org plugin directory.
• Never install “nulled” or pirated premium plugins. They’re a common way malware gets onto sites.
• Be wary of abandoned plugins that haven’t been updated in a long time, even if they still work.

The same thinking applies to apps on Shopify and other hosted platforms: remove what you don’t use and review what each app can access. A lean, well-built WordPress website needs far fewer plugins than one assembled from a multipurpose theme.

Protect your forms

Contact and booking forms attract spam and abuse. Use spam protection such as a CAPTCHA or a honeypot field, and don’t ask for sensitive information you don’t need. Never collect payment card details through a plain contact form; use a proper payment or booking provider.

Signs your site may have been hacked

Watch for:

• Google search results showing your site with strange titles, foreign-language text or pharmaceutical spam.
• A warning in Google Search Console’s Security Issues report.
• Browsers or Google showing a warning that the site is dangerous.
• Visitors being redirected to other sites, sometimes only on mobile or only when arriving from Google.
• New admin users or pages you didn’t create.
• Your host suspending the account or emailing about malware.

Adding your site to Google Search Console is free and is one of the easiest ways to hear about problems early. Our Search Console guide for owners walks through setting it up and what to check.

What to do if your site is hacked

Don’t panic, and don’t start deleting things at random. Deleting files can destroy clues about how the attacker got in, and a site that looks clean can still hide a backdoor. Work through the recovery steps below in order, starting with a call to your host.

If you don’t have a clean backup or the time to work through it, this is where outside help pays off. Our website care plans cover updates, backups and monitoring so you’re far less likely to end up here.