“Why would anyone hack my little website?” It’s a reasonable thought, but most attacks aren’t personal. Automated programs constantly scan the internet for sites with known weaknesses, whatever their size. Small business sites are often targeted precisely because they’re less likely to be maintained.
The good news is that a few basics protect most sites from most problems.
1. Use a secure connection (HTTPS)
The padlock in the browser’s address bar means information sent between your visitor and your site is encrypted. Without it, many browsers show a “Not secure” warning, which scares off visitors and can affect search rankings. Certificates are widely available for free, so there’s no reason not to have one.
2. Keep everything updated
If your site runs on a system like WordPress, the core software, themes and plugins all need regular updates. Many updates fix security holes that attackers already know about. An out-of-date site is one of the most common ways small businesses get hacked.
3. Remove what you don’t use
Every plugin, theme or add-on is another thing that could have a weakness. If you installed something to try it and never used it, remove it. Fewer moving parts means fewer things to go wrong.
4. Use strong, unique passwords
Use a long, unique password for your website admin, your hosting account and your domain registrar, and turn on two-factor authentication wherever it’s offered. A password manager makes this easy.
Don’t share logins: if someone needs access, give them their own account with only the permissions they need, and remove it when they’re done.
Security handled for you
Hosting, the secure padlock, backups and ongoing maintenance are all included in your plan. $49.99 a month, cancel anytime.
See what’s included →5. Have regular backups, stored separately
Backups are your safety net. If something goes wrong, whether a hack, a broken update or an accidental deletion, a recent backup lets you restore your site quickly. Make sure backups happen automatically and are stored somewhere other than the website itself.
6. Protect your forms
Contact forms attract spam bots. Simple protections, such as hidden spam traps or a lightweight check, cut most of it out without annoying real visitors. Forms should also never ask for sensitive details you don’t need.
7. Choose decent hosting
Your hosting provider handles a lot of security behind the scenes: server updates, firewalls and monitoring. The cheapest option isn’t always the safest.
Signs something might be wrong
- Your site redirects visitors to strange pages
- Search results for your site show unfamiliar text or products
- Your browser or search engine warns that the site may be harmful
- You notice admin users or pages you didn’t create
If you see any of these, act quickly: change your passwords, contact your host, and restore from a clean backup if needed.
The bottom line
Website security for a small business comes down to a few habits: the padlock, regular updates, strong passwords and reliable backups. Get those right, or have someone handle them for you, and you’ve covered the vast majority of the risk.