Summary: Small business websites are frequent targets for automated attacks. A handful of basic measures prevents most problems.
Many owners believe hackers would not bother with a small business site. In reality, automated bots scan the internet constantly for vulnerable websites, regardless of size.
Essential measures
- SSL certificate: HTTPS for every page
- Updates: keep CMS, themes and plugins updated
- Strong passwords and two-factor authentication for admin accounts
- Limit admin users and remove old accounts
- Web application firewall to block common attacks
- Regular backups stored off-site
- Malware scanning
Forms and spam
Protect forms with spam filters, honeypots or CAPTCHA alternatives to avoid junk submissions and abuse.
Hosting security
Choose hosts with server-level security, isolation between accounts and quick support.
Domain security
Lock your domain at the registrar, enable two-factor authentication and keep contact emails current.
If you are hacked
- Take a backup of the current state for investigation.
- Restore from a clean backup or clean the infected files.
- Change all passwords.
- Update software and close the vulnerability.
- Check Search Console for security warnings.
FAQs
Is free SSL enough?
For most websites, yes.
How often should we back up?
Daily backups are a good standard.
Do security plugins slow sites?
Some can; choose lightweight, reputable options.
