Website security, made practical.
Small businesses assume hackers only target big companies. The opposite is true: automated attacks scan the whole web indiscriminately, and small sites — often unmaintained and under-protected — are the easiest targets. A compromised site can cost you customers, rankings, reputation and money, usually all at once.
Website security for a small business rests on a handful of essentials: HTTPS/SSL to encrypt connections, strong unique passwords with multi-factor authentication (MFA) on every account, regular automated backups stored off-site, a web application firewall, malware scanning, keeping all software updated, and monitoring for problems. Most attacks on small sites are automated and opportunistic, not targeted, so basic protection blocks the vast majority. WordPress sites need extra care — hardening, minimal vetted plugins, and prompt updates — because their popularity makes them a favourite target. Security is far cheaper as prevention than as recovery.
What this guide covers
Why small businesses are targets, not bystanders
The comforting myth is that hackers only go after big organisations with something worth stealing. The reality is that most attacks aren't targeted at all — they're automated. Bots scan millions of websites continuously, probing for known weaknesses: outdated software, weak passwords, unpatched plugins, missing protections. They don't know or care whether you're a national bank or a one-person plumbing firm; they're looking for an open door, and small unmaintained sites have the most of them.
The costs of a compromise are real and stack up fast: your site defaced or taken offline (lost enquiries), customer data exposed (legal and reputational damage, GDPR consequences), your site used to attack others or send spam (blacklisting), Google flagging you as unsafe (rankings and traffic gone, plus a scary browser warning greeting visitors), and the time and cost of cleaning up. Prevention is dramatically cheaper than recovery — which is the whole argument for taking it seriously before anything goes wrong.
The security essentials, ranked
You don't need to be a security expert. A handful of fundamentals block the overwhelming majority of automated attacks:
| Essential | What it does | Priority |
|---|---|---|
| HTTPS / SSL | Encrypts data between visitor and site | Essential (and free) |
| Strong, unique passwords | Blocks the most common entry route | Essential |
| Multi-factor authentication (MFA) | Stops password-only breaches | Essential |
| Regular off-site backups | Lets you recover from anything | Essential |
| Software updates | Closes known vulnerabilities | Essential |
| Web application firewall (WAF) | Blocks malicious traffic | High |
| Malware scanning | Detects compromise early | High |
| Monitoring & alerts | Catches problems fast | Medium-High |
Notice that several are free and none are exotic. Security for a small business is far more about consistently doing the basics than about sophisticated defences — most breaches exploit neglect, not ingenuity.
HTTPS, passwords and MFA
HTTPS / SSL
HTTPS (the padlock) encrypts the connection between your visitor and your site, protecting any data that passes — form submissions, logins, payments. It's free via Let's Encrypt on any decent host, it's a Google ranking signal, and browsers now actively warn visitors away from sites without it. There is no reason to be without HTTPS in 2026; a site still on plain HTTP is insecure, penalised and alarming to visitors simultaneously. It's covered as a fundamental in technical SEO too.
Strong passwords and MFA
Weak and reused passwords are the single most common way sites get breached. The rules are simple and non-negotiable: every account (hosting, CMS, email, domain registrar) needs a strong, unique password — long and random, ideally generated and stored by a password manager. And enable multi-factor authentication everywhere it's offered: even if a password is stolen, MFA requires a second factor (a code on your phone) that an attacker doesn't have. MFA alone blocks the vast majority of account-takeover attempts, and it takes minutes to set up.
Backups: your last line of defence
If everything else fails — a successful hack, a bad update, a server failure, human error — a recent backup is what stands between a bad day and a catastrophe. Backups are the most important security measure precisely because they let you recover from anything.
Do them properly: automated (manual backups are the ones that don't happen), regular (frequency matched to how often the site changes), stored off-site (a backup on the same server as the site dies with the server), and — this is the part people skip — tested. A backup you've never tried to restore is a hope, not a safety net; discovering it's corrupt during an actual emergency is a special kind of misery. Good hosting and good maintenance include proper backups as standard, which is part of what ongoing maintenance buys you.
Firewalls, malware scanning and updates
Web application firewall (WAF)
A WAF sits in front of your site and filters incoming traffic, blocking malicious requests — automated attacks, injection attempts, known bad actors — before they reach your site. Services like Cloudflare provide a capable WAF, often on a free tier, and it dramatically reduces the volume of attacks that ever get through.
Malware scanning
Scanning checks your site for signs of compromise — malicious code, unexpected changes, known malware — so that if something does get through, you find out early rather than when Google blacklists you or a customer reports a warning. Early detection turns a potential disaster into a quick fix.
Keeping software updated
Most successful hacks exploit known vulnerabilities that already have fixes available — the site simply hadn't applied them. Every piece of software (the CMS, plugins, themes, server software) needs prompt updating, because each update often patches security holes that attackers are actively scanning for. Neglected updates are the single biggest avoidable risk, and the reason abandoned sites get compromised so reliably. Staying current is the least glamorous and most important security habit there is.
WordPress security in particular
WordPress powers a huge share of the web, which makes it a favourite target — not because it's inherently insecure, but because its popularity and its plugin ecosystem give attackers a large, familiar attack surface. If you run WordPress, extra care is warranted, as covered in the WordPress services and evaluation guides:
- Minimise plugins, and only use ones that are well-reviewed, actively maintained and from reputable sources. Every plugin is potential entry point; an abandoned or poorly-coded one is a genuine risk.
- Update relentlessly — core, themes and plugins — because WordPress vulnerabilities are widely known and actively exploited the moment they're disclosed.
- Harden the install — strong admin credentials with MFA, limit login attempts, change the default admin username, restrict file permissions, and remove anything unused.
- Use a security plugin or a WAF configured for WordPress to block the common attack patterns.
Much of the "WordPress is insecure" reputation comes from unmaintained sites bristling with outdated plugins — a maintenance failure more than a platform one. A properly built and maintained WordPress site is perfectly secure; a neglected one is an open door.
Monitoring, response and the maintenance connection
Security isn't a one-time setup — threats evolve, software needs patching, and problems need catching quickly. Monitoring (uptime checks, malware scans, change detection, security alerts) means you learn about issues fast, when they're small, rather than discovering them via lost traffic or an angry customer.
And have a rough response plan: if the worst happens, knowing you have recent tested backups, knowing who to call, and being able to take the site offline and restore it turns a crisis into a procedure. The reassuring truth is that a small business doesn't need enterprise security — it needs the basics, done consistently and kept up. That "kept up" is exactly why security and ongoing maintenance are really the same conversation: the updates, backups, monitoring and patching that keep a site secure are the substance of good maintenance. A site nobody is looking after is a site slowly becoming vulnerable, whatever it looked like on launch day.
Frequently asked questions
Why would hackers target my small business website?
Most attacks aren't targeted — they're automated. Bots continuously scan millions of sites for known weaknesses like outdated software and weak passwords, regardless of the business's size. Small, unmaintained sites tend to have the most open doors, making them easy opportunistic targets.
What are the most important website security measures?
HTTPS/SSL, strong unique passwords with multi-factor authentication on every account, regular automated off-site backups, keeping all software updated, a web application firewall, and malware scanning. Several are free, and consistently doing these basics blocks the vast majority of automated attacks.
Is HTTPS necessary for a small website?
Yes. HTTPS encrypts data between visitors and your site, is a Google ranking signal, and browsers now warn visitors away from sites without it. It's free via Let's Encrypt on any decent host, so a site on plain HTTP is insecure, penalised and alarming to visitors all at once.
What is multi-factor authentication and should I use it?
MFA requires a second verification step beyond your password — usually a code on your phone — so a stolen password alone can't grant access. You should enable it everywhere it's offered (hosting, CMS, email, domain registrar); it blocks the vast majority of account-takeover attempts and takes minutes to set up.
How often should I back up my website?
Automatically and regularly, with frequency matched to how often the site changes — daily for active sites, weekly for static ones. Store backups off-site (not on the same server as the site) and test that they actually restore. An untested backup is a hope, not a safety net.
What is a web application firewall (WAF)?
A filter that sits in front of your site and blocks malicious incoming traffic — automated attacks, injection attempts, known bad actors — before it reaches you. Services like Cloudflare offer a capable WAF, often free, dramatically reducing the attacks that get through.
Why is keeping software updated so important for security?
Because most successful hacks exploit known vulnerabilities that already have fixes available — the site just hadn't applied them. Each update often patches security holes attackers are actively scanning for, so prompt updating of your CMS, plugins, themes and server software is the single biggest avoidable risk to manage.
Is WordPress secure?
WordPress isn't inherently insecure, but its popularity and plugin ecosystem make it a favourite target. Most 'WordPress is insecure' cases are unmaintained sites with outdated plugins — a maintenance failure. A properly built and maintained WordPress site with minimal vetted plugins, prompt updates and hardening is perfectly secure.
How do I make WordPress more secure?
Minimise plugins and use only well-reviewed, actively maintained ones; update core, themes and plugins relentlessly; harden the install with strong admin credentials and MFA, limited login attempts, and a changed default username; and use a security plugin or WAF configured for WordPress.
What happens if my website gets hacked?
Consequences can include the site being defaced or taken offline, customer data exposed, your site used to attack others or send spam, Google blacklisting you with a browser warning, and lost rankings and trust. Recovery means restoring from a clean backup, removing the compromise and closing the hole — far costlier than prevention.
Do I need expensive security software for a small business site?
No. A small business needs the basics done consistently — HTTPS, strong passwords with MFA, backups, updates, a firewall and monitoring — most of which are free or inexpensive. Security is far more about maintaining the fundamentals than about sophisticated or costly defences.
How does website maintenance relate to security?
They're largely the same thing. The updates, backups, monitoring and patching that keep a site secure are the substance of ongoing maintenance. A site nobody is looking after gradually becomes vulnerable as software ages and vulnerabilities accumulate, whatever its condition at launch.
Related: Website maintenance · Web hosting · Development standards · Technical SEO
Key takeaways
- Most attacks are automated and opportunistic — small unmaintained sites are the easiest targets, not bystanders.
- The essentials block the vast majority: HTTPS, strong passwords + MFA, backups, updates, a firewall, malware scanning.
- MFA alone stops most account takeovers and takes minutes; enable it everywhere.
- Backups are the last line of defence — automated, off-site, and actually tested.
- Most hacks exploit known vulnerabilities with fixes available — prompt updates are the biggest avoidable risk.
- WordPress needs extra care — minimal vetted plugins, relentless updates, hardening — but is secure when maintained.
- Security and maintenance are the same conversation: an unwatched site slowly becomes vulnerable.
Worried your site isn't protected?
Every site I build and maintain includes HTTPS, backups, updates and monitoring as standard — security isn't an add-on. Send me your site and I'll give you an honest read on where it's exposed.