Website Security Basics for Small Business Owners
Website security for a small business comes down to a short list of habits: protect the accounts that control your site, keep software updated, give each person only the access they need, keep backups and learn the early warning signs. None of this needs technical skills, and most steps take only minutes.
Why small sites get attacked
Attacks are mostly automated. Programs scan huge numbers of sites for known weaknesses and weak passwords, and they do not choose targets by size. Government guidance for small organisations makes the same point: small businesses are about as likely to face online crime as large ones, and many recommended steps take only a few minutes. Security is also everyone's job, not only the person who built the site.
Protect the accounts that control your site
Most real incidents begin with an account, not with code. List every account that can change your site: email, domain registrar, hosting, the website platform or admin panel, and tools connected to the site. Then:
- Give each one a long, unique password, ideally stored in a password manager.
- Turn on two-step sign-in, starting with the email account, because it can reset all the others.
- Do not reuse the password of any account on another service.
Keep software updated
Updates often close weaknesses that attackers already know about. Update the platform, the theme and the plugins regularly, and remove the ones you no longer use. Fewer add-ons mean fewer places for something to go wrong. Before large updates, make a copy, as described in the backup guide.
Limit who has access
Create separate logins for each person instead of sharing one password. Give a freelancer only the rights the job needs, and remove the access when the project ends. Keep a short written list of who has access to what, so nothing is forgotten when people change.
Use a secure connection and protect forms
Check that your site loads over HTTPS, as explained in the HTTPS guide. If you collect messages, protect the form from spam and abuse, as described in the form spam guide.
Back up and prepare
A tested backup is the best protection against many problems. Also write down who to contact at your host and domain registrar, and where the login details are stored. If something goes wrong, you will not be searching for them under stress.
Spot trouble early
Watch for signs that something is not right.
- Pages or links you did not create, especially unrelated ads.
- Strange results when you search your own site name.
- Sign-in alerts for accounts you did not use.
- Emails that pretend to be your host or bank and push you to log in through a link.
- A sudden slowdown or warnings from your browser.
Phishing messages are one of the most common ways accounts are taken over. Do not click the link: go to the service by typing its address yourself.
If your site is hacked
- Change the passwords of the accounts connected to the site, starting with email.
- Contact your host, who may help clean the site or restore a copy.
- Restore from a clean backup and update everything before bringing the site back online.
- Find out how the attacker got in, so the same gap is closed.
What a good password looks like
Length matters more than tricks. A long phrase of several unrelated words is stronger and easier to remember than a short mix of symbols. The key rule is that every account gets its own. Reuse is what turns one leaked password into several broken accounts. A password manager removes the memory problem, and it can fill in logins only on the real address of a site, which helps against fake login pages.
Secure your email first
Your email account is the master key, because it receives the reset links for everything else. Give it the strongest password and two-step sign-in, check the list of devices that are signed in and look at the forwarding rules from time to time, since attackers sometimes add a rule that quietly copies your mail. If your domain sends email, setting up the records described in the SPF, DKIM and DMARC guide makes it harder for others to send mail that looks like yours.
A short monthly routine
- Check that the platform, theme and plugins are up to date, and delete the ones you do not use.
- Look at the list of users and remove people who no longer need access.
- Confirm that the latest backup exists and is stored away from the host.
- Skim the sign-in alerts and any security messages from your host.
- Open your own site on a phone and look for pages or links you do not recognise.
What to tell people who work with you
Agree on simple rules: no sharing passwords in chat, no installing unknown plugins, no using the admin account for daily work, and report anything odd at once. When a freelancer finishes, ask them to confirm they have removed any saved logins, and remove their access yourself as well. Written rules protect both sides and make it easier to find the cause if something goes wrong.
FAQ
Do I need a security plugin?
It can help on platforms that attract attacks, but it does not replace strong passwords, updates and backups. Choose one from a trusted source and keep it updated.
Is a website builder safer than a self-hosted site?
A builder handles many technical tasks for you, which lowers the work. Your accounts still need strong passwords and two-step sign-in.
How do I know if my password was leaked?
Some password managers and browsers can check stored passwords against known leaks. If a service reports a breach, change the password at once.
Should I give my developer admin access?
Give them the access the task needs and remove it afterwards. Agree on this in writing.
How often should I review security?
A short review every month or two is enough for a small site: check updates, users, backups and logins.
Your next step: turn on two-step sign-in for the email account tied to your domain and hosting. It protects everything else.