Website security basics for small businesses

Automated scans look for exposed accounts and known software vulnerabilities on sites of all sizes. A small business needs a clear owner for security tasks, even if the website is simple.

Start by listing the accounts and services involved: domain registrar, hosting, email, CMS, source repository and payment provider. Losing access to any one of them can disrupt the site.

Protect access

Use unique passwords and a password manager. Enable multi-factor authentication where available, especially for domain, email and hosting accounts. Keep recovery details somewhere the business can access, and remove access when a team member leaves.

Give each person their own account with only the permissions they need. A shared administrator password makes it difficult to revoke access or understand who changed something.

Keep software current

Apply security fixes promptly. For a CMS, include its plugins and themes; for a static site, include build tools and connected services. Remove components you no longer use.

Before a significant update, take a backup and test the change in a separate environment. Then verify the live site, including forms, sign-in and checkout. Automatic updates still need monitoring.

Use HTTPS and appropriate browser protections

HTTPS encrypts the connection to the site. Check that HTTP redirects to HTTPS and that certificate renewal works. An encrypted connection does not prove that the site itself is trustworthy or free of vulnerabilities.

Security headers can help, but they must fit the application. A Content Security Policy copied from another site can break forms, fonts or payment embeds. Test a policy before enforcing it. A firewall is an additional layer, not a replacement for fixing vulnerable software.

Back up what you would need to recover

Include content, uploaded files, databases and the configuration needed to restore the service. Keep a separate copy outside the production account or server, restrict access and test restoration regularly. Choose the backup frequency according to how much recent work the business can afford to lose.

Static sites reduce some risks because serving their pages does not require a public database or CMS login. They still depend on accounts, dependencies and third-party scripts. Our Hugo guide explains that distinction.

If you suspect a compromise

Restrict the affected service and contact the person responsible for hosting or security. Preserve logs and evidence before rebuilding. Investigate the entry point, revoke exposed credentials and sessions, patch the cause, and restore from a known clean state. Check connected services as well as the visible pages.

Unexpected redirects, new administrator accounts or content nobody published all deserve investigation. Search-ranking changes alone do not establish that a site was hacked.