Website Security Basics for Businesses Without a Security Team

Small business sites are compromised by automated scanners, not targeted attackers. The defences that stop them are unglamorous and cheap.

Nobody chose your website specifically. Automated scanners crawl the internet testing known vulnerabilities against every address they find, and a site running an outdated plugin is compromised within days of the vulnerability becoming public. The defence is not sophistication; it is not being the easiest target on the block.

The measures that stop most incidents

1. Update everything, promptly. The overwhelming majority of compromises exploit vulnerabilities that had a patch available. Automate updates where you can and schedule the rest.
2. Two-factor authentication on every admin account, hosting panel and domain registrar. Password reuse is the second most common route in.
3. Remove what you do not use. Every unused plugin, theme and dormant admin account is attack surface that provides zero value.
4. Backups you have actually restored. An untested backup is a belief, not a plan — test the restore once, and you will find out which one you have.
5. HTTPS everywhere, with automatic renewal so nobody has to remember an expiry date.

For anything handling customer data

• Never store what you do not need. Payment details belong with your payment provider, not in your database.
• Limit admin access to people who currently need it, and review the list quarterly. Former staff and former contractors are a standard finding.
• Log administrative actions, so an incident can be reconstructed rather than guessed at.
• Rate-limit login attempts and forms, which stops both credential stuffing and the spam that arrives at 4am.

When something happens

Decide the sequence now, while nothing is on fire: take it offline, preserve logs before cleaning, restore from a known-good backup rather than trying to clean in place, rotate every credential, and only then investigate the entry point. If customer data was involved, breach notification obligations apply in most US states and across the EU — with deadlines measured in days. If you want it checked rather than assumed, it is what our cybersecurity service does.

• days from public vulnerability to automated exploitation
• 1 tested restore, not just a backup
• 2FA on domain, hosting and admin

More on this topic: Web & Product.

Want this built for your business? See what we do.