How to Improve Business Website Security

Small business websites are attacked constantly, almost never by someone targeting that business in particular. Automated tools scan the internet for known weaknesses and exploit whatever they find. That is good news in one respect: you do not need to be impenetrable. You need to not be the easy one.

A handful of basic measures stops the large majority of these attacks. Here they are in priority order.

1. Protect your logins

Stolen and guessed passwords are among the most common ways sites are compromised.

• Use a unique, long password for every account: hosting, domain registrar, website admin, email.
• Use a password manager so you do not have to remember them.
• Turn on two-factor authentication everywhere it is offered, especially your domain registrar and email. Email matters most, because password resets for everything else go there.
• Give each person their own login. Never share one account.
• Remove access immediately when someone leaves or a contractor's work ends.
• Limit administrator rights to those who need them.

2. Keep software updated

Outdated software is the other leading cause. When a flaw is discovered in a popular platform or plugin, a fix is released, and attackers begin scanning for sites that have not applied it.

• Update your content management system, themes and plugins promptly.
• Remove plugins and themes you are not using. Inactive ones can still be exploited.
• Only install plugins from reputable sources that are actively maintained.
• Enable automatic updates where you can.

If your site runs on a hosted platform such as Shopify, Wix or Squarespace, the platform handles this. If it runs on WordPress or similar, it is your job or your developer's.

3. Back up, and test the backup

Backups do not prevent an attack. They decide whether an attack is an inconvenience or a disaster.

• Back up automatically, at least daily for an active site.
• Store backups somewhere separate from the website. A backup on the same server is lost with it.
• Keep several versions, in case a problem goes unnoticed for a while.
• Test restoring. An untested backup is a hope, not a plan.

4. Use HTTPS everywhere

HTTPS encrypts the connection between a visitor and your site. Browsers mark sites without it as "Not secure", and Google has used it as a ranking signal for years.

• Every page should load over https://.
• The plain http:// version should redirect automatically.
• Certificates are free through services such as Let's Encrypt, and most hosts install them for you.
• Make sure it renews automatically. An expired certificate shows visitors a full-page warning.

5. Choose hosting carefully

• Use a host that keeps its servers updated and offers a firewall and malware scanning.
• Avoid the very cheapest shared hosting for a site that matters.
• Managed hosting, where the provider handles security and updates, is worth the extra cost for most businesses.

6. Protect forms

Forms are an entry point for spam and abuse.

• Add spam protection, such as a hidden "honeypot" field or a challenge service.
• Collect only what you need.
• Validate what is submitted.
• Never display submitted content on your site without it being cleaned.

7. Handle payments the right way

Do not process or store card details yourself. Use an established payment provider or your platform's built-in checkout, so card data goes straight to them. This keeps you out of most of the obligations of the card industry's security standard, which the PCI Security Standards Council publishes.

8. Lock down the domain

Your domain controls your website and your email. See domains vs hosting.

• Keep it in your own account with two-factor authentication.
• Turn on the registrar's transfer lock.
• Keep auto-renew on.

9. Monitor

• Uptime monitoring tells you when the site goes down.
• Google Search Console warns you if Google detects malware or hacked content. Set it up if you have not.
• Check occasionally for pages, users or links you did not create.

Signs your site may be compromised

• Visitors are redirected to unrelated sites.
• Unfamiliar pages or links appear.
• Browsers or Google show a security warning.
• Admin accounts you do not recognize.
• A sudden drop in search traffic.
• Your host suspends the site.

If it happens

1. Do not panic, and do not delete everything.
2. Change all passwords: hosting, admin, database, email.
3. Contact your host, who can often help identify and contain the problem.
4. Restore from a clean backup made before the compromise.
5. Update everything before bringing the site back.
6. Find how they got in, or it will happen again.
7. Check your legal obligations. If personal data was exposed, you may be required to notify those affected. This depends on your location and the data involved, so take advice.

The ten-minute version

If you do nothing else today:

• Turn on two-factor authentication for your email and domain registrar
• Confirm backups exist and are stored off the server
• Apply any pending updates
• Remove users and plugins you no longer need

For broader guidance, CISA's cybersecurity resources for small businesses are free and written for non-specialists. No checklist makes a site invulnerable, but these steps move you well out of the group that automated attacks succeed against.