Website security guide
Small-business website security basics
Security is not a one-time plugin or a badge. It is a set of ordinary habits that makes account takeover, outdated software and recovery failures less likely.
The useful numbers, with the conditions attached.
- Protect the accounts that control the domain, hosting, content and payments.
- Keep software, permissions and backups under an agreed maintenance process.
- Know who acts first if the site is unavailable or appears compromised.
Protect the accounts behind the website
The most damaging website incident may begin outside the website dashboard: a compromised registrar, hosting, email or payment account can change where visitors are sent or who controls the site. List the accounts that matter and make sure their recovery details belong to the business.
Use unique passwords and multi-factor authentication where the service provides it. Give each person their own access instead of sharing one administrator login. That makes offboarding possible and helps the business understand who can change what.
- Domain registrar
- Hosting or platform
- Content management system
- Business email
- Analytics, forms and payment services
Keep the software surface small and current
Every plugin, theme, script and integration adds a maintenance responsibility. Keep what the site needs, remove what is unused and avoid installing tools merely to solve a temporary visual request. A smaller, understood system is easier to update and investigate.
Schedule updates, but do not apply them blindly to an important production site without a recovery plan. Test meaningful changes where possible, take or confirm a backup, and check core journeys afterwards. The same discipline applies when a supplier updates the site on your behalf.
- Inventory of active software
- Named update owner
- Backup before significant changes
- Post-update form and checkout tests
Use least-privilege access and clean handovers
Not every editor needs full administrative rights. Give people the smallest role that lets them do their work, and review access when someone changes role or leaves. This reduces accidental changes as well as account abuse.
Keep a secure handover record rather than relying on one person’s memory. It should identify the accounts, role holders, renewal contacts and recovery route. Do not treat a shared spreadsheet full of passwords as a security plan; use a suitable secure method for credentials.
- Individual accounts
- Appropriate roles
- Access review on staff changes
- Secure credential handling
Prepare for a problem before it happens
Write a short response note: who checks the issue, who can contact hosting support, how customer-facing messages are approved and where the latest backup information lives. A simple plan helps a small team avoid panic and contradictory changes when a site is unavailable.
After any incident, review what happened without looking for a convenient culprit. Confirm accounts, update access, assess affected pages or forms, and improve the procedure that would have caught the issue earlier. Recovery is also a chance to make the site less fragile.
- Technical contact
- Business decision owner
- Support contact details
- Backup and recovery reference
- Customer communication plan
Common questions
Questions worth settling before you commit.
Does HTTPS make a website secure?
It protects the connection between a visitor and the site, but it does not replace account security, updates, access control or backups.
How often should I update the website?
Follow the platform’s needs and the risk of the components in use. Set a documented maintenance rhythm and respond promptly to relevant security notices.
What is the first thing to do if the site is hacked?
Use the prepared contacts and recovery process, protect affected accounts and involve the hosting or platform provider. Avoid uncoordinated changes that can destroy evidence or hinder recovery.