Website security basics for small business owners

Small business website security comes down to a handful of habits, not a special product: keep the software updated, protect every login with a strong password and a two-step code, have a backup you know you can restore, make sure the site runs on HTTPS, and know exactly who has access. Most hacked small business sites were not targeted by anyone. They were found by automated programs that scan the internet for an old plugin or a reused password. Close those doors and you are out of reach of most of the trouble.

Why anyone would bother with a small website

Owners often think, "Nobody is interested in my bakery's website." That is true, and it does not matter. The attacks that hit small sites are automated. A program tries millions of sites a day, looking for a known weakness in a specific version of WordPress, a theme or a plugin, or trying common passwords on login pages. When it finds one, the site is used for something: sending spam, hosting fake shopping pages, redirecting visitors to scams, or serving pages of junk links to search engines.

You may not notice for weeks. Customers might, when their phone shows a warning, or when Google lists pages you never wrote.

The accounts that really matter

Your website is not one account. It is usually three or four, and each one can undo the others:

The domain registrar (where you bought your web address). Whoever controls this controls where your address points and where your email goes.
The hosting or website builder account. Where the site itself lives.
The website's own login, if it has one, such as the WordPress admin.
Your email account. Password resets for all the others arrive here, so it is the master key.

Write down where each one is and which email address it uses. Many owners discover that one of them is still in the name of a nephew or a long-gone web designer. Keeping website and domain logins safe covers how to sort this out.

The five habits

1. Keep software updated

If your site runs on WordPress or a similar system, the core software, the theme and every plugin receive security fixes. An old plugin with a known hole is the most common way in. Log in at least monthly, apply updates, and delete plugins you are not using rather than just switching them off; switched-off plugins can still be exploited.

Website builders such as Squarespace, Wix and others handle these updates for you. That is a real advantage of them for owners who do not want this job.

2. Use strong, unique passwords

Every one of the accounts above should have its own long password that you do not use anywhere else. When a big website you once signed up for gets breached, criminals try the same email and password everywhere. A password manager, including the one built into your phone or browser, can create and remember these for you.

3. Turn on two-step verification

Two-step verification (also called two-factor or 2FA) means that after your password, the account asks for a code from your phone. A stolen password alone is then not enough. Turn it on for your registrar, hosting, website login and email, in that order of priority. An authenticator app is safer than text messages, but text messages are far better than nothing. Two-factor authentication for your domain and email has the steps for the common providers.

4. Keep backups you have actually tested

A backup is a copy of your website you can go back to. Ask your host or provider three questions:

How often is the site backed up, and how far back do the copies go?
Where are the backups kept? (A backup on the same server as the site can disappear with it.)
How do I restore one, and can you show me?

A backup that has never been restored is a hope, not a plan. Once a year, ask your provider to restore a copy somewhere harmless and check it works.

5. Make sure your site uses HTTPS

HTTPS is the secure version of a web address, shown by a padlock or a settings icon next to the address in the browser. It encrypts what passes between the visitor and your site, which matters most on your contact form. Most hosts and builders provide the certificate that makes it work at no extra charge, and browsers warn visitors about sites without it. Type your address with "http://" in front and check it moves to "https://" on its own.

Smaller things that add up

Change the default admin name. On WordPress, an administrator called "admin" makes password guessing easier.
Limit login attempts. Many hosts and security plugins can lock out an address after several wrong passwords.
Give people only the access they need. A staff member who updates the blog needs an "editor" role, not full control.
Be wary of "your domain is expiring" emails. Phishing messages about websites and domains are common. Log in to your registrar directly instead of clicking the link. Phishing emails about your domain shows what the usual ones look like.
Protect the contact form from spam with a check that blocks bots without making customers solve puzzles.

Where the simplest sites have an edge

The more moving parts a site has, the more there is to keep patched. A WordPress site with twenty plugins needs regular care. A site made of plain pages served as files, with no admin login exposed on the site itself and no plugins to update, has far fewer weak points. If you dread the monthly update routine, that is a fair thing to weigh when your site is next replaced.

What to do this week

Make a list of your registrar, hosting, website login and email accounts, with the email address each uses.
Turn on two-step verification on the first one that does not have it.
Change any password you have used on another site.
If you run WordPress, log in, apply updates and delete unused plugins.
Ask your host how backups work and how a restore is done.
Check your site moves to https:// on its own.

If your site needs so much patching that it feels like a second job, you can see your site rebuilt first on a simpler setup and compare.