Security can feel like a subject for big companies with IT departments. In reality, small businesses are often easier targets, precisely because they don’t have anyone watching. Most attacks aren’t personal. They’re automated, looking for any website or account with a known weakness. That’s why website security basics matter for small businesses too.
The good news is that a handful of basic habits deal with a large share of everyday risk. None of them require technical expertise, just a bit of organisation and someone who’s responsible for them.
Here’s the website security checklist we’d want every small business to have ticked off.
Protect your website and data
1. Backups you’ve actually tested
Backups are your safety net for everything: hacks, accidental deletions, failed updates and hardware failure. But a backup you’ve never restored is really just a hope.
- Back up automatically. Websites, databases and key business files should be backed up on a schedule, not when someone remembers.
- Keep copies off-site. A backup stored on the same server as your website won’t help if that server has a problem.
- Keep several versions. If a problem goes unnoticed for a week, you need a backup from before it started.
- Test a restore. A couple of times a year, check you can actually get your site or data back from a backup. It’s the only way to know it works.
2. Updates, applied promptly
Software updates often include security fixes. Once a weakness is publicly known, automated attacks tend to start looking for sites and devices that haven’t been patched.
For websites, that means the platform itself, plus plugins, themes and extensions. Content management systems such as WordPress are generally secure when kept up to date, but out-of-date plugins are a common way in. Remove any you don’t use, since inactive plugins can still be a risk.
For the business more widely, keep computers, phones and routers updated too. Switch on automatic updates wherever it’s sensible.
One caution: on a busy website, updates can occasionally break things. That’s why updates and backups go together, and why it’s worth having someone check the site afterwards.
Protect your accounts
3. Two-factor sign-in on everything important
Two-factor authentication (2FA) means that as well as a password, you need a second proof, usually a code from an app on your phone. Even if a password is stolen, the account stays protected.
Prioritise these accounts:
- Email, because it’s used to reset every other password
- Your domain name registrar and hosting
- Website admin accounts
- Banking, accounts software and payment platforms
- Social media and advertising accounts
Where you have a choice, an authenticator app is generally considered more secure than codes sent by text message.
If you only do one thing after reading this, switch on two-factor sign-in for your business email today.
4. Better passwords, managed properly
Reusing passwords is one of the biggest everyday risks. When one site is breached, attackers try the same email and password everywhere else.
- Use a password manager so every account can have a long, unique password nobody needs to remember.
- Give each person their own login rather than sharing one account.
- Remove access promptly when someone leaves or a supplier’s work ends.
5. Only the access people need
Not everyone needs to be an administrator. Give staff and suppliers the lowest level of access that lets them do their job. It limits the damage if an account is compromised and reduces accidents.
Have a plan for when something goes wrong
Write down, on one page, what you’d do if your website was hacked or your email compromised. Who do you call? Where are the backups? Who can reset accounts? If personal data is involved, you may need to report a breach to the ICO, and there are time limits, so it helps to know that in advance and take advice when it happens.
Useful free guidance
The National Cyber Security Centre publishes practical, free guidance aimed at small businesses, and it’s worth a read. The government-backed Cyber Essentials scheme is also a good framework if you want a recognised standard, and some contracts require it.
Your website security to-do list for this month
- Switch on 2FA for email, domain, hosting and website admin.
- Check when your website was last backed up and where the backup lives.
- Look for out-of-date or unused plugins and deal with them.
- Review who has admin access and remove anyone who shouldn’t.
- Set up a password manager for the team.
If you’d like someone to handle it
Much of website security is routine work that’s easy to let slide. Our website and system security service covers the basics properly, and ongoing updates and backups are part of our website maintenance and support plans.
