Website Security Basics Every Business Owner Should Know

Your Website Is a Target (Yes, Yours)

One of the most common things I hear from small business owners is: “Why would anyone hack my website? I’m just a small business.” It’s a fair question, but the answer might surprise you.

The vast majority of website attacks aren’t targeted. Hackers don’t sit in a dark room deciding to go after your specific plumbing company or café. Instead, they use automated tools that scan the entire internet for known vulnerabilities. Your website isn’t targeted because of who you are — it’s targeted because it exists.

These automated attacks probe thousands of websites per hour, looking for outdated software, weak passwords, and common security holes. When they find one, they exploit it — often to inject spam links, redirect visitors to malicious sites, mine cryptocurrency, or use your server to send phishing emails.

The damage goes beyond the hack itself. A compromised website can destroy customer trust, damage your search rankings (Google warns users about hacked sites), and cost you time and money to clean up. I’ve seen small businesses lose weeks of revenue because their website was taken down by an attack that was entirely preventable.

HTTPS: The Non-Negotiable Foundation

If your website still uses HTTP instead of HTTPS, stop reading and fix that first. An SSL/TLS certificate encrypts the connection between your visitors’ browsers and your server, protecting any data transmitted — including form submissions, login credentials, and payment information.

Why It Matters

• Data protection. Without HTTPS, anything your visitors submit on your website can be intercepted. Contact form details, login credentials, payment information — all transmitted in plain text.
• Browser warnings. Modern browsers flag HTTP sites as “Not Secure” in the address bar. This kills trust immediately.
• SEO impact. Google has confirmed HTTPS as a ranking signal. HTTP sites are at a disadvantage.
• Compliance. If you collect any personal data (even a name and email through a contact form), HTTPS isn’t optional — it’s a legal expectation under GDPR.

How to Get HTTPS

Most hosting providers offer free SSL certificates through Let’s Encrypt. If yours doesn’t, switch providers. There’s no excuse for not having HTTPS in 2025. Once installed, make sure all HTTP URLs redirect to HTTPS automatically.

Keep Everything Updated

The single most common cause of website compromises is outdated software. This applies to everything: your CMS, your themes, your plugins, your server software, and your programming language.

Why Updates Matter

When a security vulnerability is discovered in WordPress (or any software), the developers release a patch. But here’s the catch — the vulnerability is now public knowledge. Hackers know about it too, and they immediately start scanning for websites that haven’t applied the update.

I’ve seen WordPress sites hacked within 48 hours of a security update being released — because the site owner hadn’t applied it. The update announcement essentially served as a roadmap for the attack.

A Practical Update Strategy

• Enable automatic updates for minor WordPress core releases and security patches.
• Check for plugin and theme updates weekly. Set a recurring reminder.
• Remove plugins and themes you’re not using. They can still be exploited even when deactivated.
• Test updates on a staging site if possible, especially for major version changes.
• Keep PHP updated on your server. Running an outdated version of PHP is a significant security risk.

Strong Passwords and User Management

It sounds obvious, but weak passwords remain one of the top attack vectors. “Password123” and “admin” as login credentials might seem laughable, but automated tools try these (and thousands of variations) on every website they find.

Password Best Practices

• Use a unique, randomly generated password for every account. Password managers like 1Password or Bitwarden make this practical.
• Minimum 16 characters, mixing uppercase, lowercase, numbers, and symbols.
• Never reuse passwords across sites. If one site is breached, every account with the same password is compromised.
• Change your WordPress admin username from the default “admin” to something unique.

Two-Factor Authentication

Two-factor authentication (2FA) adds a second layer of security beyond your password. Even if someone guesses or steals your password, they can’t log in without the second factor — typically a code from an authenticator app on your phone.

If your CMS or hosting provider offers 2FA, enable it. It’s one of the most effective security measures available and takes seconds to use.

Limit User Access

Only give people the access they need. If someone only needs to publish blog posts, they don’t need administrator access. WordPress has multiple user roles (Administrator, Editor, Author, Contributor, Subscriber) for exactly this reason. Use them.

Remove accounts for people who no longer need access. A former employee’s forgotten login is a potential entry point.

Protect Your Login Page

The login page of your CMS is the front door of your website’s administration. By default, WordPress puts it at /wp-admin or /wp-login.php — which every hacker on the planet knows.

Practical Protections

• Limit login attempts. After a certain number of failed attempts (say, five), lock out that IP address temporarily. Plugins like Limit Login Attempts Reloaded handle this.
• Change the login URL. Moving your login page to a custom URL stops automated bots from finding it. It’s security through obscurity — not bulletproof on its own, but effective as part of a layered approach.
• Use CAPTCHA or similar challenges. Adding a challenge to your login form stops automated brute-force attacks.
• Block known malicious IPs. Your hosting provider or a security plugin can maintain lists of IP addresses known for malicious activity and block them automatically.

Backups: Your Safety Net

No security measure is 100% effective. Backups are your insurance policy. If the worst happens, a recent backup means you can restore your website quickly rather than rebuilding from scratch.

Backup Best Practices

• Automate your backups. Don’t rely on remembering to do it manually.
• Back up everything. Files and database. A file backup without the database (or vice versa) is incomplete.
• Store backups off-site. If your server is compromised, backups stored on the same server are useless. Use cloud storage or a separate backup service.
• Test your backups regularly. A backup you’ve never tried to restore is a backup you can’t trust.
• Keep multiple versions. If your site was hacked last week and you only have one backup from yesterday, it might contain the hacked files. Keep several weeks of daily backups.

How Often to Back Up

It depends on how frequently your site changes. An e-commerce site with daily orders should back up daily. A brochure site that changes monthly might be fine with weekly backups. When in doubt, back up more frequently — storage is cheap compared to the cost of lost data.

Web Application Firewalls

A web application firewall (WAF) sits between your website and the internet, filtering out malicious traffic before it reaches your server. Think of it as a bouncer for your website.

Services like Cloudflare (which has a generous free tier) can provide WAF protection along with DDoS mitigation and CDN services. For WordPress specifically, plugins like Wordfence provide firewall functionality.

A WAF can block common attacks like SQL injection, cross-site scripting (XSS), and brute-force login attempts. It’s not a replacement for other security measures, but it’s a valuable additional layer.

Secure Your Forms

Contact forms, search bars, and any other input fields on your website are potential entry points for attacks. Two common attacks target forms specifically:

SQL Injection

An attacker enters malicious database commands into a form field, attempting to manipulate or extract data from your database. Properly built websites sanitise all input to prevent this, but many older or poorly coded sites are vulnerable.

Cross-Site Scripting (XSS)

An attacker injects malicious scripts through form fields. If your site displays user input without sanitising it first, those scripts can execute in other visitors’ browsers — stealing cookies, session tokens, or redirecting to malicious sites.

Prevention

• Never trust user input. Always validate and sanitise data on the server side.
• Use parameterised database queries to prevent SQL injection.
• Encode output to prevent XSS.
• Add CAPTCHA to public-facing forms to prevent automated submissions.
• If you’re using a CMS with form plugins, keep them updated.

The Modern Alternative

One reason I’m a strong advocate for modern, static-first website architectures is security. A static website — pre-built HTML files served from a CDN — has a dramatically smaller attack surface than a traditional CMS.

There’s no database to inject into. No admin panel to brute-force. No plugins to exploit. No PHP to manipulate. The server simply serves files. It’s not invulnerable (nothing is), but it eliminates entire categories of common attacks.

If security is a priority for your business — and it should be — it’s worth considering whether a modern architecture might serve you better than a traditional CMS.

What to Do If You’ve Been Hacked

If you suspect your website has been compromised:

1. Don’t panic, but act quickly. The longer a compromise goes unaddressed, the more damage it can do.
2. Take the site offline temporarily if possible, to prevent further damage.
3. Restore from a clean backup if you have one from before the compromise.
4. Change all passwords — CMS admin, database, FTP, hosting control panel.
5. Update everything — CMS, plugins, themes, PHP.
6. Scan for malware using security tools.
7. Check Google Search Console for security alerts and request a review once cleaned.
8. Review how it happened and plug the vulnerability.

Take Action Today

Website security isn’t something to think about later. Every day your site runs with outdated software, weak passwords, or no HTTPS is a day it’s vulnerable.

Start with the basics: HTTPS, strong passwords, regular updates, and automated backups. These four steps alone will protect you from the vast majority of common attacks.

If you’re unsure about your website’s security posture, or if you’d like to discuss moving to a more secure architecture, get in touch. I’ll give you an honest assessment of where you stand and practical recommendations for improvement.