Website security basics for small businesses

Small business owners often assume hackers only go after big companies. In practice, most attacks are automated: software scans the internet for sites running out-of-date plugins or using weak passwords, and breaks into whatever it finds. Your site is not being picked out personally. It is simply being checked, over and over, for the easy mistakes. The good news is that a short list of habits closes most of those doors.

1. Make sure the site uses HTTPS

HTTPS is the padlock in the browser address bar. It encrypts the connection between your visitor and your site so that other people on the same network cannot read or alter what passes between them. Browsers now warn visitors away from sites without it, and form submissions on a plain HTTP site can be intercepted.

• Type your address starting with http:// and check that it jumps to https:// automatically.
• Make sure the certificate does not expire. Most hosts renew it automatically; confirm that yours does.
• If your site shows a mix of secure and insecure content, ask your developer to fix it.

2. Keep software updated, or have less of it

The most common way small sites get broken into is an outdated plugin, theme or content management system. Every extra plugin is extra code that someone has to keep patched. If you run a platform with plugins:

• Delete plugins and themes you do not use. Deactivating is not enough.
• Turn on automatic updates where available, or schedule a monthly check.
• Avoid plugins that have not been updated in a long time.

There is another option: a site built as plain, pre-made pages has no database and no admin login on the live site, so there is far less to attack. That is how we build sites at Raijin Studios, and it is one reason a static site is a good fit for a business that mainly needs to inform and take enquiries.

3. Use strong, unique passwords and two-factor sign-in

Reused passwords are a major risk. When one service is breached, attackers try the same email and password everywhere else. The fix is simple:

• Use a password manager to create and store a different long password for every account.
• Turn on two-factor authentication (2FA), where signing in also needs a code from your phone, on the accounts that matter most: your email, your domain registrar, your hosting account and your website admin.
• Prefer an authenticator app or a hardware key over text messages where you have the choice.

Your email deserves special care. Whoever controls your email can reset the password on almost everything else.

4. Protect your domain name

Your domain name is the address of your business online. If someone takes over your registrar account, they can point your address somewhere else. Use a strong password and 2FA on the registrar account, make sure the contact email on it is one you control, and turn on the registrar lock, a setting that blocks the domain being transferred away without your approval. Keep the renewal date in your calendar, and turn on auto-renew.

5. Keep backups, and test them

A backup is what turns a disaster into an inconvenience. Ask your host or developer three questions: how often are backups taken, where are they stored (not only on the same server), and when did anyone last try to restore one? A backup you have never tested is a hope, not a plan.

6. Give contractors only the access they need

When a freelancer or agency finishes a job, their access should end. Give each person their own login rather than sharing yours, grant the lowest level of access that lets them do the work, and review the list of users every few months. Remove anyone you no longer work with.

7. Protect your forms from spam and abuse

Contact forms attract automated spam. Good protection includes a challenge that tells humans from bots (without making real people solve puzzles), checks on the server rather than only in the browser, and limits on how fast a form can be submitted. Never put secret keys or passwords in code that visitors can view.

8. Security headers, explained simply

Security headers are short instructions your website sends along with each page that tell the browser to be stricter. They are invisible to visitors, but they block whole categories of attack. The common ones:

• Strict-Transport-Security tells browsers to only ever use HTTPS for your site.
• Content-Security-Policy lists which sources a page may load scripts and styles from, which limits the damage if something malicious is injected.
• X-Content-Type-Options stops the browser guessing file types, which closes a trick used to sneak in harmful files.
• Frame options stop other sites from displaying yours inside their pages to trick visitors into clicking.
• Referrer-Policy and Permissions-Policy limit what information and device features the browser shares.

You can check your own site for free, no account needed, with securityheaders.com or the MDN HTTP Observatory. Type in your address and read the report. If there are many red marks, show it to whoever manages your site and ask which ones they can fix.

What to do if your site is hacked

Signs include pages you did not create, strange redirects, a warning from your browser or Google, or your host suspending the site. Stay calm and work through this order:

1. Contact your host and tell them. Many can isolate the site and help.
2. Change passwords on your hosting, website admin, domain registrar and email, from a device you trust, and switch on 2FA.
3. Do not simply delete what looks suspicious and carry on. Restore a clean backup taken before the problem began, or rebuild the site cleanly, and update everything.
4. Find out how they got in (usually an outdated plugin or a stolen password) so the same door does not open again.
5. If customer details may have been exposed, check what notification rules apply to you and inform the people affected.

A five-minute checklist

Your site uses HTTPS; software and plugins are current or removed; every important account has a unique password and 2FA; registrar lock and auto-renew are on; backups exist and have been tested; former contractors have no access; your forms are protected; and you have run your address through a security headers checker.

How Raijin Studios approaches it

We build sites as pre-made static pages with strict security headers, HTTPS everywhere and protected forms, so there is no database or admin panel on the live site to attack. We also give clients a short checklist for their domain, email and hosting accounts. You can read more on our security page, or ask for a free audit of your current site.

Sources and further reading

• securityheaders.com, a free header checker
• MDN HTTP Observatory, a free security scan
• MDN: Web security guide