Website security basics for a business that has no IT department

The most common objection to website security is reasonable on its face: who would bother hacking a plumber in Chatham? The answer is that nobody chose you. Automated scripts crawl the entire internet looking for known vulnerabilities, and a compromised small business site is useful for sending spam, hosting phishing pages, mining crypto, or injecting links into your pages to prop up somebody else's rankings.

The good news is that the defences are unglamorous and finite. Eight things cover almost all of it.

How small business sites actually get compromised

1. An outdated plugin, theme or CMS core. By far the most common. A vulnerability is published, automated scanners begin probing for it within hours, and unpatched sites are found within days.
2. Weak or reused passwords. Credentials leaked from an unrelated breach, tried automatically against your login page.
3. No two-factor authentication, so a leaked password is sufficient on its own.
4. Abandoned software. A plugin whose author stopped maintaining it years ago, still installed and still running.
5. A compromised computer. Malware on the machine used to administer the site steals the session or the saved password.
6. Nulled or pirated themes and plugins, which very frequently ship with a backdoor. This is the point of distributing them.

The eight defences that matter

1. Update everything, promptly

If you run a CMS, updates are the job. Enable automatic updates for security releases, check monthly that they are applying, and remove any plugin you are not actively using — an inactive plugin is still code on the server.

2. Two-factor authentication everywhere

In priority order: domain registrar, hosting account, CMS admin, email, Google Business Profile. The registrar comes first because domain theft is the hardest thing on the list to undo. Use an authenticator app rather than SMS where both are offered.

3. Unique passwords, in a password manager

Every account gets a different long random password. Use a password manager — Bitwarden's free tier is genuinely sufficient — and stop trying to remember them. Reused passwords are how one unrelated breach becomes six compromised accounts.

4. Backups you have actually tested

• Automated daily backups of files and database.
• At least one copy stored somewhere other than the web server itself.
• Retention of at least thirty days — compromises are often discovered weeks later, and by then the recent backups contain the compromise.
• A restore tested at least once, so you know the process and know it works.
• One manual copy you personally hold, taken before any major change.

5. Least privilege on accounts

Nobody needs administrator access to write a blog post. Give each person the lowest role that lets them do their job, and audit the user list twice a year. The account of a contractor who worked on the site in 2022 is a live door.

6. HTTPS everywhere, enforced

Free certificate, http redirecting to https, and no mixed content. Consider HSTS once you are confident https works everywhere, which instructs browsers never to attempt the insecure version.

7. Protect the login page

If your site has an admin login, limit login attempts, and add a firewall or your host's built-in protection. Where the platform supports it, restrict admin access by IP address. If your CMS uses a well-known login URL, changing it stops a lot of automated noise — it is obscurity rather than security, but it does reduce the volume.

8. Watch for changes

• Uptime monitoring that alerts you when the site goes down.
• Google Search Console — it reports security issues and manual actions directly.
• A malware or file-change scan on a schedule if you run a CMS.
• Check the site yourself monthly in a private window, from a phone.

Warning signs you have been compromised

• Google shows a 'This site may be hacked' warning in the search results.
• Search Console reports a security issue.
• Pages you did not create appear, often for pharmaceuticals, gambling or counterfeit goods.
• The site redirects somewhere else — sometimes only for visitors arriving from Google, or only on mobile.
• It became noticeably slower for no reason.
• Customers report warnings you cannot reproduce.
• New admin users exist that nobody created.
• Your host suspends the account for sending spam.

The first hour if it happens

1. 01Take the site offlineA maintenance page is better than a compromised site. Every hour it stays up damages your search reputation and risks your visitors.
2. 02Change every password, from a clean deviceHosting, CMS, database, FTP, registrar, email. Use a computer you are confident is not itself compromised.
3. 03Contact your hostMost have dealt with this many times, have logs you do not, and can often identify the entry point quickly.
4. 04Restore from a backup predating the compromiseThis is why thirty-day retention matters. Restoring yesterday's backup often restores the compromise with it.
5. 05Patch the hole before going back onlineRestoring without fixing the vulnerability means being compromised again within days, usually by the same script.
6. 06Remove every unexpected user and keyAttackers routinely add a second admin account or an SSH key so they can return after you change the password.
7. 07Request a review in Search ConsoleOnce genuinely clean, request a security review to clear the warning. It takes days, not hours.
8. 08Write down what happenedEntry point, dates, what you changed. In a year, when someone asks whether that old plugin was the problem, you will want the note.

What is worth paying for