Website security basics every business owner should know

Most small business websites are not attacked by someone who chose them on purpose. They are found by automated tools that scan the internet day and night for weak passwords, outdated software and known holes. That is good news, because a few basic habits close the doors those tools look for: keep software updated, protect every login, give people only the access they need, keep backups away from the site and watch for warning signs. You do not need to become a security expert, but you do need someone clearly responsible for these habits.

How business websites usually get compromised

• Outdated software. Old versions of WordPress, themes or plugins with publicly known flaws.
• Weak or reused passwords. The same password used for the website, Facebook and email.
• Pirated themes and plugins. "Free" copies of paid products, often called nulled, frequently carry hidden malicious code.
• Shared logins. Several staff members and former freelancers all using one admin account.
• Phishing. A convincing email or message asking someone to "verify" their hosting or domain login.
• Abandoned add-ons. A plugin its developer no longer maintains.

The result can be spam pages added to your site, visitors redirected to scams, a warning beside your site in Google or your customers' data being copied.

The essential habits

1. Keep everything updated

Update the core software, themes and plugins regularly, and remove anything you do not use. Before major updates, take a backup and, ideally, test on a copy of the site first.

2. Protect every login

Use long, unique passwords stored in a password manager. Turn on two-step verification for the website admin, hosting, domain registrar, email and Facebook accounts. Losing control of your email or domain can be worse than losing the website itself.

3. Give each person their own account

Every staff member and developer should have their own login with only the permissions they need. An editor who writes articles does not need administrator rights. When someone leaves, remove their access the same day.

4. Keep backups somewhere else

Automatic backups should run regularly, and at least one copy should be stored away from your hosting server. A backup you have never tried to restore is a hope, not a plan.

5. Use HTTPS everywhere

Every page should load over HTTPS, especially forms and login pages.

6. Choose software carefully

Install plugins and themes only from reputable sources, check that they are actively maintained and avoid piling up plugins for small jobs.

7. Watch for warning signs

Uptime monitoring tells you when the site goes down; see uptime monitoring explained. Also look out for unfamiliar admin users, strange pages showing in Google results, sudden traffic to odd pages or a warning email from your host.

Who is responsible for what

Security is shared. Your hosting company protects the server's physical and network side to a degree. Your developer or maintenance provider handles updates, configuration and backups. You, the owner, decide who gets access and keep your own accounts secure. Write down who does what so nothing falls between people. A maintenance and backup plan makes those responsibilities clear.

If you think your site has been hacked

1. Stay calm and do not delete everything in a panic; you may destroy useful clues.
2. From a clean device, change the passwords for hosting, the website admin, the domain registrar and email.
3. Contact your host and your developer.
4. Restore from a clean backup if you have one, then find and close the hole the attacker used, or it will happen again.
5. Check Google Search Console for security warnings and request a review once the site is clean.

The full step-by-step approach is in recovering a hacked WordPress site.

Customer data deserves extra care

If your site collects names, phone numbers, addresses or order details, collect only what you need, limit who can see it and delete what you no longer use. Rules on personal data differ between countries and change over time, so ask a lawyer what applies to you, especially if you sell abroad.

A short monthly check

• Are the software and plugins up to date?
• Are there any admin users you do not recognise?
• Is the latest backup present and stored off the server?
• Is the SSL certificate valid?
• Any warnings from your host or Google?

If you would like someone to look after these habits for you, see my web development service, or get in touch for a second pair of eyes on your current set-up.