Website security for small businesses

Do these first

1. Update everything. Your CMS, plugins, themes and extensions. Most break-ins use a known flaw that already has a fix. Turn on automatic updates where you can.
2. Lock down logins. A unique, long password for every administrator, two-factor authentication, and remove accounts nobody uses.
3. Have backups you have tested. Daily, stored away from the website, and restored at least once so you know they work.
4. Use HTTPS everywhere. A valid certificate, and every http:// address redirecting to https://. The SSL checker shows both.
5. Know who has access. Hosting, domain registrar, DNS and CMS: a list of who can log in, with two-factor authentication on each.

Then close the common gaps

• Remove files that should never be public: backups, .env files, database dumps, old copies of the site. A scan finds these.
• Add security headers, the instructions your site gives browsers. The headers checker grades yours and gives copy-paste fixes.
• Protect your email domain with SPF, DKIM and DMARC so nobody can send email in your name. See SPF, DKIM and DMARC explained.
• Delete plugins, themes and test sites you no longer use: they are still attack surface.

Keep watching

• Uptime monitoring, so you hear about an outage before your customers do.
• Certificate and domain expiry warnings, the two most avoidable outages.
• Alerts for changes you did not make: DNS records, homepage content, new scripts on checkout pages.
• A regular malware check. Hacked sites often show spam only to Google, so you will not see it yourself; the free malware scanner checks for that.

A 15-minute monthly check

1. Log in to the website and apply any pending updates.
2. Look at the list of administrator accounts and remove anyone who no longer needs access.
3. Check that last night's backup exists and is a sensible size.
4. Open the site in a private browser window from your phone and from a Google search, and check nothing looks odd.
5. Look at your monitoring and scan results, and fix the top item on the list.

Who should do what

Write down who is responsible for each part: the hosting account, the domain and DNS, the website software, backups and email. If a designer or agency built the site, agree in writing whether they also update it after launch. Many small business hacks happen in the gap where everyone assumed someone else was handling updates.

Signs your website may have a problem

• Customers mention a browser warning, strange redirects or pop-ups you have never seen.
• Google Search Console reports security issues, or search results for your site show pages in other languages or about pharmacy, casino or loans.
• Your hosting provider suspends the account or warns about high resource use or sending spam.
• New administrator users, plugins or files you did not add, or settings that changed by themselves.
• Emails from your domain start landing in spam, or people receive emails "from you" that you never sent.

None of these prove a hack on their own, but each is worth checking the same day. The guide how to check if your website is hacked walks through what to look at.

Passwords and access, in practice

• Use a password manager so every account gets its own long, random password.
• Turn on two-factor authentication for the website, the hosting control panel, the domain registrar and your email, in that order of importance.
• Give staff and contractors their own accounts instead of sharing one, so access can be removed when someone leaves.
• Keep the email address that receives password resets for these accounts as secure as the accounts themselves: whoever controls it controls them.

If something goes wrong

Do not panic and do not delete everything. Take a copy of the site as it is, change all passwords, and follow a recovery plan: our guide my website was hacked: what to do walks through it step by step. If you use Webforta, every website has a recovery checklist built from what Webforta has seen on that site.

Where Webforta fits

Webforta covers the watching part for you: scans with a fix for every finding, uptime, certificate, DNS and content monitoring, an hourly malware check on Starter, Pro and Business, a 0 to 100 security score that lists the most valuable fixes first, and a website firewall on Pro and Business. You can start on the Free plan (1 website, 4 on-demand scans a month and hourly uptime and certificate checks) or try everything for 14 days.