Small Business Website Security: A Practical Checklist

Published October 15, 2026 · Last updated October 24, 2026 · By the WebSolutions LLC team

Small business websites are rarely attacked by someone who has chosen them personally. They are found by automated scanners that sweep the internet for known weaknesses: an out-of-date plugin, a reused password, an open admin page, a forgotten test copy. The good news is that the same small set of habits blocks most of these attacks. This guide walks through them in plain language, in roughly the order we would tackle them on a new client site.

For broader business guidance beyond the website itself, the US Federal Trade Commission's cybersecurity for small business resources and NIST's Small Business Cybersecurity Corner are both free and worth bookmarking.

1. Lock down every account that controls the site

Your website is only as secure as the weakest login connected to it. That list is longer than most owners expect: the CMS admin, the hosting control panel, FTP or SSH, the database, the domain registrar, the DNS provider, and any email account that can reset those passwords.

• Use a unique, long password for each account, stored in a password manager.
• Turn on multi-factor authentication (MFA) everywhere it is offered. CISA notes that any MFA is better than none, and recommends phishing-resistant options such as FIDO/WebAuthn security keys or passkeys where possible (CISA on MFA).
• Give each person their own login with only the permissions they need, and remove former staff and contractors promptly.
• Use SFTP or SSH rather than plain FTP. Google's malware prevention guidance specifically recommends avoiding plain-text protocols (Google Search Central).

2. Keep software and plugins updated

Outdated software is one of the most common ways small sites are compromised. The OWASP Top 10 2025, the widely used list of critical web application risks, includes Security Misconfiguration (A02) and Software Supply Chain Failures (A03) near the top, which covers vulnerable or untrusted third-party components.

• Update the CMS core, plugins, themes and server software on a regular schedule, and apply security releases quickly.
• Remove plugins, themes and scripts you do not use. Deactivated code can still be exploited if it remains on the server.
• Install extensions only from reputable sources and check that they are still maintained.
• Ask your host which PHP or runtime version your site uses and whether it still receives security fixes.

Our website maintenance checklist turns these tasks into a weekly and monthly routine.

3. Use HTTPS everywhere

HTTPS encrypts traffic between the visitor and your server, protecting form submissions, logins and cookies from being read or altered in transit. Free certificates are widely available; Let's Encrypt, for example, does not charge for its certificates and issues them with a 90-day lifetime by default (Let's Encrypt FAQ). Our guide what is an SSL certificate explains certificate types, renewal and the most common certificate errors.

• Redirect all HTTP requests to HTTPS with a permanent redirect.
• Automate certificate renewal. Maximum public certificate lifetimes are shrinking in stages, to 200 days from March 2026 and down to 47 days by 2029, so manual renewal is no longer realistic (DigiCert).
• Once HTTPS works everywhere, consider the Strict-Transport-Security (HSTS) header so browsers always use the secure version.
• Fix mixed content, where an HTTPS page still loads images or scripts over HTTP.

4. Back up, and keep a copy somewhere else

Backups are what turn a hack or a failed update from a disaster into an inconvenience. CISA's ransomware guidance recommends keeping offline, encrypted backups of critical data and regularly testing that they can be restored (CISA #StopRansomware Guide).

• Back up both files and the database, as often as the site changes.
• Keep at least one copy off the web server and out of reach of the hosting account's credentials.
• Test a restore at least every few months. If you are changing hosts, our website migration checklist explains how to do it without losing data.

5. Harden forms, logins and the server

• Validate input on the server. Contact, search and checkout forms should reject unexpected input. Injection remains in the OWASP Top 10 (A05:2025).
• Protect login pages. Limit repeated failed attempts and avoid exposing admin areas to the whole internet where your platform allows it.
• Check file and directory permissions and turn off directory listing so visitors cannot browse your folders.
• Keep test and staging copies private. Forgotten copies on subdomains are often less protected than the live site.
• Hide error details. Detailed error messages shown to visitors can reveal file paths and software versions. Log them privately instead.
• Choose hosting carefully. The FTC's small business pages include guidance on hiring a web host and on vendor security, both useful when comparing providers.

6. Protect your domain and email

Attackers often go after the domain and email rather than the website itself. Enable registrar lock and MFA on your registrar account, keep the contact email current, and set up the email authentication records SPF, DKIM and DMARC so criminals find it harder to send email that appears to come from your domain. The FTC's small business cybersecurity pages cover email authentication in plain language, and our guide to DNS and DNS records explains where these records live and how to check them.

7. Monitor, so you hear about problems first

• Verify your site in Google Search Console and check the Security issues report, which lists hacked content and malware Google has detected.
• Forward Search Console messages to an inbox someone reads.
• Run an occasional site:yourdomain.com search to spot pages you did not create.
• Use uptime monitoring and review server logs for unusual spikes, new admin users or unexpected file changes.

What to do if your website is hacked

1. Restrict access to the site or put it into maintenance mode to protect visitors.
2. Change every password connected to the site and revoke unknown users and API keys.
3. Work out how the attacker got in, so the same hole is closed before you restore.
4. Restore clean files and data from a backup taken before the compromise, then update all software.
5. If Google flagged the site, fix the issues listed in the Security issues report and request a review.

Website security is part of our development and maintenance services. If you have questions about your own site, read our FAQs or get in touch.