Website Security Basics Every Business Owner Should Know

Most small business websites get hacked not through some sophisticated targeted attack, but through outdated software: an old plugin with a known vulnerability, a weak or reused password, or a server that hasn't been patched in months. The good news is that the handful of basics that stop the vast majority of these attacks are neither expensive nor technical to understand, even if implementing some of them takes a developer's help.

Why Small Businesses Are Actually Bigger Targets Than They Think

Most website attacks aren't a person manually deciding to target your business. They're automated bots scanning millions of sites for known, unpatched vulnerabilities and weak login credentials. Your website doesn't need to be valuable or high-profile to get hit, it just needs to be running outdated software that a bot recognizes. That's why "we're too small to be a target" is the wrong way to think about it. Small sites are often easier targets precisely because they get less attention and fewer updates. The UK's National Cyber Security Centre publishes similar guidance for small organisations, and the pattern it describes matches what we see with clients here too: it's rarely personal, it's just automated and opportunistic.

Keep Everything Updated, Especially Plugins

If your site runs on WordPress or a similar content management system, plugins and themes are the most common entry point for attackers. A plugin that hasn't been updated in a year or more, or one abandoned by its developer entirely, is a known risk. Set a routine, weekly or monthly depending on how many plugins you run, to check for and apply updates, or have your hosting company or developer do it as part of ongoing website maintenance. Remove plugins and themes you're not actively using. An inactive plugin is still a security risk even if it's not currently doing anything visible.

Use Strong, Unique Passwords and Turn On Two-Factor Authentication

Password reuse is one of the most common ways accounts get compromised. An unrelated website you use gets breached, the leaked password gets tried against your admin login, and if you reused it, you're in trouble. A password manager solves this cleanly by generating and storing a unique password for every login without you needing to remember them.

• Use a unique, long password for your admin login, hosting account and domain registrar account, each different from the others.
• Turn on two-factor authentication (2FA) anywhere it's offered, particularly your hosting account, domain registrar, and CMS admin login. This alone stops most automated login attacks even if a password does leak.
• Limit the number of people with admin access, and remove access promptly when someone leaves the business or a project ends.

Install an SSL Certificate and Keep the Whole Site on HTTPS

An SSL certificate encrypts the data moving between your website and your visitors, which matters for anything involving forms, logins or payments, and it's also a baseline trust and search ranking factor now. Most hosting providers include free certificates from services like Let's Encrypt as standard, so there's rarely a reason not to have one active and enforced across every page. We go into this in more detail in our guide to SSL certificates and HTTPS if you want the full picture.

Use a Web Application Firewall

A web application firewall (WAF) sits between visitors and your website, filtering out known attack patterns, malicious bots and suspicious traffic before they ever reach your server. Many hosting providers offer a basic WAF built in, and dedicated services add another layer specifically tuned to common CMS platforms. It won't stop everything, but it meaningfully reduces the volume of automated attacks that reach your site at all.

What a Firewall Won't Catch

A firewall filters traffic patterns. It doesn't fix vulnerable code sitting on your server, and it won't catch a legitimate-looking login using a stolen password. Think of it as one layer among several, not a replacement for updates and access control.

Limit Login Attempts and Hide Obvious Entry Points

Brute-force login attempts, where a bot tries thousands of password combinations against your admin login, are extremely common and easy to block. Most CMS platforms have plugins or built-in settings to limit failed login attempts and temporarily lock out an IP address after a few failures. Moving your admin login away from the default, predictable URL adds a small additional layer, though it's a minor deterrent rather than real security on its own.

Back Up Your Site Regularly, and Test the Backup

Even with every precaution in place, security incidents still happen, and a recent, working backup is what turns a disaster into an inconvenience. A backup that's never been tested isn't really a backup. At some point, restore it to a staging environment and confirm it actually works. We cover backup strategy and disaster recovery in more depth in a separate article, since it deserves its own attention.

Watch for the Early Warning Signs

A compromised site doesn't always announce itself immediately. Watch for unexpected new admin users you didn't create, pages or posts appearing that nobody on your team wrote, your site being flagged by Google Search Console or showing a "this site may be hacked" warning in search results, a sudden unexplained drop in search traffic (which can indicate spam content injected into your site that only search engines see), or your hosting provider emailing you about unusual server activity. If you notice any of these, act quickly: change all admin passwords immediately, and get a developer or your hosting provider to scan and clean the site rather than waiting to see if it resolves on its own.

Don't Forget the Server Underneath the Website

Website security and server security are related but not identical, and it's easy to secure one while overlooking the other. Even a perfectly updated CMS can be exposed if the underlying server is running outdated software, has an open port it doesn't need, or is missing basic firewall rules. This is one reason managed hosting or managed IT support is worth the extra cost for many small businesses: a competent provider handles server-level patching as part of the plan, closing a layer of risk that's largely invisible from inside your website's admin dashboard.

Securing Contact Forms and File Uploads

Contact forms and file upload fields are a quieter attack surface that owners often overlook. A form without spam protection quickly becomes a magnet for bots submitting junk, and worse, some forms accept file uploads that, if not properly restricted, can be tricked into accepting a disguised script instead of the resume or image they were meant for. A basic spam filter or CAPTCHA on public forms cuts down junk submissions considerably, and any upload field should restrict file types and sizes on the server side, not just in the browser, since browser-side checks are trivial to bypass.

Employee and Vendor Access Hygiene

A lot of avoidable security incidents trace back to access that should have been revoked and wasn't: a former employee's login still active months after they left, a freelancer's temporary access that was never removed, a shared password nobody rotated after a team change. Keep a simple, current list of who has access to what (hosting, domain registrar, CMS admin, analytics) and review it whenever someone joins or leaves the business. It's a five-minute task that closes a surprisingly common gap.

A Realistic Baseline, Not a Perfect One

No combination of these measures makes a website unhackable. And any security vendor promising that isn't being straight with you. What these basics do is take you out of the pool of easy, automated targets, which is where the overwhelming majority of small business attacks come from. Markmydigi handles this as part of our IT services and website support for a number of clients, precisely because these are small, routine tasks that are easy to skip when nobody owns them explicitly.

Frequently asked questions