Website security sounds like something only big companies need to worry about. It isn't. Small business sites get attacked constantly — not because anyone has singled you out, but because automated bots scan the whole internet looking for sites with easy weaknesses to exploit.
The reassuring news is that most attacks succeed through a handful of basic gaps. Close those, and you've dealt with the overwhelming majority of the risk. Here's the checklist we'd run through for any small business site.
1. Is Everything Kept Up to Date?
Out-of-date software is the single most common way sites get hacked. On WordPress, that means core, themes and plugins. Updates often exist because a security hole was found — so running old versions is leaving a known door unlocked. If nobody is responsible for keeping your site updated, that's the first thing to fix.
2. Are You on HTTPS?
Look at your address bar. If there's a padlock and the address starts with https://, good. If it says "Not secure", that's a problem — both for security and because browsers warn visitors away. An SSL certificate is essential and, on decent hosting, should be included as standard.
3. Are Passwords Strong and Unique?
"admin" and "password123" still let attackers in more often than you'd believe. Every login should use a long, unique password, and your admin account should never be called "admin". Better still, turn on two-factor authentication so a password alone isn't enough to get in.
4. Do You Have Real Backups?
When something goes wrong — a hack, a bad update, a mistake — a recent backup is the difference between a minor inconvenience and a disaster. You need backups that run automatically, are stored somewhere separate from the site, and can actually be restored. A backup you've never tested isn't really a backup. Our managed hosting includes automatic daily backups for exactly this reason.
5. Is There a Firewall and Malware Scanning?
A web application firewall blocks malicious traffic before it reaches your site, and malware scanning catches problems early if something does slip through. On cheap shared hosting you're typically on your own here. On managed hosting, this should be handled for you.
6. Who Has Access — and Do They Still Need It?
Old developer accounts, a former staff member's login, a plugin you stopped using two years ago. Every unused account or piece of software is a potential way in. Review who and what has access, and remove anything you don't need.
The Hosting Connection
Here's the uncomfortable truth: a lot of website security depends on your hosting, and the cheapest plans cut corners precisely where security lives. Shared servers packed with thousands of sites, no proper firewall, backups you have to sort yourself, and no one watching for trouble.
We've made the case before for why cheap hosting costs more in the end, and security is a big part of that. Good hosting does a lot of this checklist for you, quietly, in the background.
Don't Wait for Something to Go Wrong
Most businesses only think about website security after an incident — when the site is down, defaced or quietly serving spam, and customers have noticed. By then it's stressful and expensive. An hour spent on the basics now is worth far more than a weekend spent cleaning up later.
If you'd like us to run this check over your site and hosting, get in touch. We'll tell you honestly where you stand and what, if anything, needs sorting.
Liked this? Get the next one in your inbox.
Monthly MWN digital digest — hosting tips, development notes, plain-English advice. No spam.