Most small business website breaches are not clever attacks. They are automated scans finding an old plugin, a guessable admin password or an exposed configuration file. The good news is that a modest set of habits removes most of that risk.
Secure the accounts first
Use a long, unique password for the CMS administrator, and never reuse your email password. Turn on two-factor authentication wherever it is offered, starting with hosting and the domain registrar because those accounts can reset everything else. Give each person who works on the site their own named account with the minimum access they need, instead of sharing one login.
Remove accounts for people who have left. This is the single most common avoidable weakness on small business sites.
Keep the platform current
Every update to a platform, theme or plugin usually exists because a problem was fixed. Running an outdated version means a problem that is already known and already patched. Ask what update schedule your maintainer follows and whether they review updates before applying them.
Be disciplined about plugins. Install only what you need, remove what you stopped using, and check that a plugin is still supported before keeping it. Some site owners also run a staging copy so updates can be tested before they go live.
Use HTTPS and keep it on
HTTPS protects traffic between a visitor's browser and your server, and browsers label sites without it as insecure. It is normally included with hosting and uses an SSL certificate that must renew. Confirm that it is active on every page including form submissions, and that the certificate renewal is automatic.
Backups you have actually tested
Backups are the difference between an inconvenience and a catastrophe. Require automatic backups to storage that is separate from the web server, so that a compromised server cannot wipe them at the same time. Keep more than one version.
A backup that has never been restored is a hope, not a plan. Ask to see a restore tested, and know roughly how long a full restore takes, because that determines how much downtime you would face.
Reduce what outsiders can see
Delete unused files, sample content and leftover installers. Keep the file manager and any database tools protected. Do not publish sensitive documents, spreadsheets containing customer data, or drafts of internal material. Set sensible permissions so that directories are not readable and files are not writable where they should not be.
When third parties are involved
Anything that runs code on your site, including chat widgets, analytics, tag managers and embedded forms, is an additional security decision. Review them periodically and remove anything no longer needed. Pay attention to whether payment pages are hosted on a recognised provider's secure checkout rather than built into your own site.
Handle payments and customer data carefully
If your site takes payments, use a recognised payment provider's hosted checkout rather than collecting card details yourself. This reduces the amount of sensitive data you are responsible for, which lowers risk considerably. If you do need to store customer information, ask explicitly what is collected, where it is stored and who has access.
Collect only what you need. A contact form that asks for date of birth or a document reference has no place on a small marketing site. Publish a short, honest privacy note explaining what you collect and why, and make sure it matches what your forms and tools actually do.
A short audit you can do today
Spend half an hour on this. List every account connected to the site and check that each has a strong unique password and two-factor authentication. Remove access for anyone who no longer needs it. Check that HTTPS is active. Confirm backups are running and ask to see the most recent one. Update the platform and plugins. Check that the contact form still delivers to a monitored inbox.
Write down what you found. That list is the starting point for any conversation with a provider.
Questions to ask a provider
Ask who will be responsible for applying updates, what happens to alert you of a compromise, how backups are stored and tested, and what the incident response plan is. Ask for the credentials of accounts the site depends on so they are not trapped with one provider. Ask what they would do in the first hour if the site were injected with malicious code.
If you want your current setup reviewed rather than rebuilt, our website development guides cover the related maintenance and performance ground. You can send us the details of your setup and we will say honestly whether it needs work.
Common questions
Is a small business website likely to be hacked?
Sites are usually targeted automatically rather than chosen, and the ones most exposed are those running outdated platforms or plugins, using weak admin passwords, or with shared hosting accounts that have been compromised elsewhere. Most compromises are opportunistic and preventable, so the basics below remove the majority of avoidable risk.
What should I do if my website is hacked?
Take it offline or lock it, then change every password from a clean device, including hosting, CMS and domain registrar accounts. Restore from a known-good backup rather than trying to clean the infected files, because injected code is often hidden. Then work out how access happened, fix that, and change passwords again before bringing the site back.
Do I need a security plugin or a firewall?
Most small business sites do not need separate paid security products. A current platform, minimal plugins, strong unique admin passwords, HTTPS, tested backups and limited user accounts cover the common cases. Extra security tools are worth considering for higher-risk sites, but they add cost and complexity and can cause conflicts if badly chosen.