Website Security Basics for Small Businesses

Why small sites are targets

"Too small to be a target" is a common belief, and a wrong one. The UK's National Cyber Security Centre (NCSC) puts it bluntly in its small organisations guide: small businesses are just as likely to experience online crime as larger ones, and 1 in 2 small businesses suffer a cyber incident every year.

A hacked website can serve spam or malware to your visitors, send your contact form data to someone else, or simply go offline. Search engines and browsers may warn visitors away until it is cleaned. The good news is that most of these attacks rely on the same few gaps, and closing them does not take a security team.

Keep everything updated

The US Cybersecurity and Infrastructure Security Agency (CISA) says in its guidance for small businesses that "many attacks succeed because the victims were running vulnerable software when a newer, safer version was available", and calls patching one of the most cost-effective things you can do. For a website, "everything" means:

• the content management system (for example WordPress), its theme and every plugin;
• the server software and the PHP or other language version it runs on;
• any libraries or frameworks a custom site is built with;
• the computers and phones you use to log in to the site.

CISA recommends turning on automatic updates where possible, and prioritising the vulnerabilities in its Known Exploited Vulnerabilities catalog, the ones attackers are known to use. Remove plugins and themes you no longer use rather than leaving them switched off, and replace any that are no longer maintained. For WordPress specifics, see our website care page.

Backups you have tested

CISA notes that many organisations hit by ransomware "either had no backups or had incomplete/damaged backups", and that "it's critical to regularly test partial and full restores". For a website, a useful backup:

• includes both the files and the database;
• runs automatically, often enough that losing the time since the last one would be acceptable;
• is kept somewhere separate from the website itself, so an attack or server failure cannot take both;
• keeps several older copies, because a problem may go unnoticed for days;
• has been restored at least once, so you know it works and how long it takes.

Multifactor authentication on every key account

CISA calls ensuring that all staff use multifactor authentication (MFA) on key systems, especially email, "the most important step an organization can make". MFA asks for a second proof, such as a code from an app or a security key, as well as the password, so a stolen password alone is not enough.

For your website, the key accounts are the ones that can change it or take it over:

• the website's admin logins;
• your hosting control panel;
• the domain registrar and DNS provider;
• the email accounts used to reset all of the above.

CISA says "any form of MFA is better than no MFA", and that phishing-resistant methods such as FIDO security keys and passkeys protect best, because they will not work on a fake login page. Start with administrator accounts. Use a password manager, so every account has its own long, unique password.

Fewer admins, fewer doors

• Give people the lowest role that does the job. Someone who writes blog posts does not need an administrator account.
• Remove accounts when people leave, including former agencies and freelancers, and review the user list a few times a year.
• Do not share logins. Each person gets their own account, so access can be removed and actions traced.
• Keep the domain in your own name and make sure more than one person in the business can log in to the registrar.

HTTPS everywhere

Every page should load over HTTPS, with plain HTTP addresses redirecting to it. HTTPS encrypts what travels between the visitor and your site, including anything typed into a form or a login page, and browsers mark pages without it as not secure. Most hosts now issue free certificates that renew automatically, but renewal can still fail, for example after a DNS change, so check that it is working. Our guide Web hosting explained covers what to ask a host about certificates and backups.

Forms, spam and visitor data

Every form is a door into your site, and the code behind it needs to treat what visitors type as untrusted. The OWASP Top 10, a standard awareness document for developers on the most critical web application security risks, is the usual reference; its 2025 list includes broken access control and injection. In practice:

• use well-maintained form tools, or have custom forms reviewed for input validation;
• add spam protection, so your inbox is not flooded and the form cannot be used to send spam to others;
• collect only the information you actually need, and do not ask for passwords, card numbers or other sensitive details by form or email;
• let a trusted payment provider handle card payments rather than your own site.

When something goes wrong

CISA advises every small business to have a written incident response plan before it is needed: who does what, who to call, and an address book that works even if your systems are down. For a website, the plan can be short:

1. Contain it. Ask your developer or host to take the site offline or into maintenance mode if it is serving spam or malware.
2. Change passwords and check MFA on the website, hosting, registrar and email, from a device you trust.
3. Restore from a clean backup taken before the problem started, then update everything before going live again.
4. Find the way in, such as an old plugin or a stolen password, and close it, or the same thing will happen again.
5. Report it. In the US you can report incidents to CISA. If visitor data may have been exposed, get advice on your legal obligations.

A monthly checklist

1. Install pending updates after taking a backup, and check the site's key pages and forms afterwards.
2. Confirm last night's backup exists, and test a restore every few months.
3. Review admin users and remove anyone who no longer needs access.
4. Check that MFA is still on for every key account.
5. Check the HTTPS certificate's expiry date and send a test message through each form.

Launching a new site? The security points also appear in our website launch checklist.

Frequently asked questions

Is my small business website really at risk?

Yes. Most attacks are automated and look for known weaknesses rather than particular businesses. The UK's National Cyber Security Centre says small businesses are just as likely to experience online crime as larger ones.

What is the single most important step?

Keep the site's software updated and turn on multifactor authentication for the website, hosting, domain and email accounts. CISA names both MFA and patching among the most effective steps a small business can take.

Does an SSL certificate make my site secure?

No. HTTPS protects data in transit between visitors and your site, which is essential, but it does not stop attacks that use outdated software or stolen passwords.

How often should a website be backed up?

Often enough that losing the time since the last backup would be acceptable: daily for most business sites, more often for busy shops. Keep backups away from the website itself and test a restore regularly.

What should I do if my website has been hacked?

Contain it, change passwords on the website, hosting, registrar and email, restore from a clean backup, find and close the way in, and report the incident. Then update everything before you go live again.

Would you rather not do this yourself? See what our website care covers, or email info@creahive.com with your web address and what worries you.