A website security checklist for small businesses
Ten practical steps that prevent most website hacks, outages and data loss — and who should be responsible for each.
Tech guideMost small business websites aren't hacked by someone targeting them. They're found by automated bots scanning the internet for outdated software and weak passwords. That's good news: a short list of habits stops the vast majority of attacks.
1. HTTPS everywhere
Every page should load over HTTPS, with plain HTTP and the www version redirecting to one secure address. Free certificates from Let's Encrypt and most modern hosts make this standard, and browsers now warn visitors on sites without it.
2. Keep software updated
Outdated plugins, themes and frameworks are the most common way in. Apply security updates promptly, remove plugins you don't use, and avoid abandoned ones that no longer receive updates.
3. Backups you have actually restored
Keep automatic daily backups of files and the database, stored somewhere other than the website's own server. A backup you've never tested restoring is a hope, not a plan — try a restore at least once.
4. Strong logins and two-factor authentication
Use unique passwords from a password manager and turn on two-factor authentication for the website admin, hosting account, domain registrar and email. Give each person their own account with only the access they need, and remove ex-staff and old agencies promptly.
5. Protect forms from spam and abuse
Contact and enquiry forms attract bots. Validate input on the server, add rate limiting and a spam check such as a honeypot field or CAPTCHA, and never email form contents somewhere that runs them as code.
6. Hosting, domain and DNS
Keep the domain in your business's own name and account, with auto-renew on — an expired domain takes down your website and email at once. Choose hosting that isolates sites, patches servers and offers a firewall or DDoS protection.
7. Know what to do if something goes wrong
Signs of trouble include unknown admin users, spam pages appearing in Google, redirects to strange sites or a warning in Search Console. Change all passwords, restore from a clean backup, update everything, then ask Google to review the site in Search Console. Write down who to call before you need them.
Frequently asked questions
How often should my website be backed up?
Daily for most business sites, and before every update. Online stores taking orders may need more frequent database backups.
Is a static or Next.js website more secure than WordPress?
A pre-rendered site has no public admin panel or plugins to exploit, so there is less to attack. It still needs updates, secure hosting and protected forms.
Do you offer website maintenance and security monitoring?
Yes. Our maintenance plans cover updates, monitoring and fixes, so these checks happen without you having to remember them.
Free consultation
Want a clear, itemised quote for your project?
Tell us what you need — we usually reply within one business day.
