Website security basics for small businesses (no IT department required)

You do not need an IT department to keep a small business website reasonably safe. You need eight habits, most of which take minutes, and a plan for the day something goes wrong anyway.

1. Updates: platform, theme and plugins

Most small business sites that get broken into were never targeted. Automated scanners crawl the web looking for a known hole in an old plugin, find it on your site, and walk in. The fix is unglamorous: keep the platform, the theme and every plugin current.

Abandoned plugins are the usual way in. A plugin nobody has updated in a year or two may still work, but nobody is fixing what gets discovered in it either. Once a month, look at your plugin list. Anything you do not use, delete rather than deactivate. Anything the author has abandoned, replace. If the site has gone years without any of this, my notes on recovering a neglected website cover the order to do things in.

2. Backups you have actually restored

A backup you have never restored is a hope, not a backup. Three things make one worth having. It lives somewhere other than the server it protects, because if that server is compromised or the hosting account is closed, a backup sitting next to it goes too. It runs on a schedule without anyone pressing a button: weekly at minimum, daily if you take orders online. And someone has restored it at least once, to a staging copy or a temporary location, and confirmed the site came back whole.

Many hosts include backups. Check how long they keep them and whether you can download a copy. Two weeks of retention is not much if you notice a problem on day sixteen.

3. Strong, unique logins and two-factor authentication

List the accounts that control your business online: domain registrar, hosting, the website admin, business email, and your Google or Microsoft account. Each should have a long password used nowhere else, with two-factor authentication turned on. An authenticator app is better than a text message; a text message is far better than nothing.

The only realistic way to keep unique passwords for a dozen accounts is a password manager. It generates them, remembers them, and lets you share a login with an employee without sending it through email. If your registrar password is also your streaming password, change that first.

4. HTTPS and the certificate behind it

HTTPS encrypts the traffic between a visitor and your site, and browsers treat its absence as a warning. If the certificate expires, visitors get a full-page "Your connection is not private" screen with a button to go back, and most of them go back. Certificates are free on nearly every host now and renew automatically when set up correctly. Confirm that yours does; on a site set up by hand years ago, renewal may still depend on someone remembering. Also check that the http:// version of your address redirects to https://.

5. DNS hygiene

DNS is the address book that points your domain at your website and your email. Know where it lives: at the registrar, at the host, or at a service such as Cloudflare. Log in and read the records. Old agencies and old tools leave entries behind: a subdomain pointing at a hosting account you closed, a verification record for a service you no longer use. A subdomain that points at nothing can sometimes be claimed by someone else and used to impersonate you. Remove what you do not recognize, after checking what it did.

At the registrar, turn on the transfer lock and make sure the contact email is one you still read. Domains are lost more often through an expired card or an unread renewal notice than through any attack.

6. Email authentication: SPF, DKIM and DMARC

Three DNS records tell the world which servers may send email for your domain (SPF), sign your messages so they cannot be altered in transit (DKIM), and tell receiving servers what to do with mail that fails those checks (DMARC). Without them, anyone can send mail that appears to come from you, and your own legitimate mail is more likely to land in spam. It is a one-time job of about an hour, and I walk through it in SPF, DKIM and DMARC explained.

7. Access review

Every few months, list who can log in to what. Former employees, the agency that built the site three years ago, the freelancer who fixed one thing, the shared "admin" account whose password is on a sticky note. Each one is a door you are not watching. Remove accounts that are no longer needed. Give people their own login instead of sharing yours, so you can remove one person without changing everything, and give each account the smallest role that does the job.

8. Monitoring, so you find out first

The difference between a bad day and a bad month is usually how quickly someone noticed. Four inexpensive checks cover most of it: uptime monitoring that emails you when the site is down; certificate expiry alerts at least two weeks out; file change detection, which catches a compromised site before Google flags it; and login alerts for new devices or repeated failed attempts on the admin and email accounts. Most hosts and security plugins offer some of this, and free uptime monitors cover the rest. Send the alerts to an address you actually read.

If you think you have been hacked

First, do not delete anything. The instinct is to clean up, but the evidence of how they got in is what lets you close the door. If the site is serving visitors something harmful, put it in maintenance mode or take it offline, and leave the files where they are.

Change passwords from a device you trust, not the one that might be compromised: hosting, website admin, email, then registrar. Turn on two-factor authentication wherever it was off. Then contact someone who does this for a living, or your host. Keep a log with times: what you noticed, what you changed, who you spoke to. It speeds up the cleanup and matters if you need to notify customers or an insurer.

The checklist

None of this is exotic; CISA's Secure Our World guidance covers the same ground. Here it is as a schedule.

Item	How often	Who can do it
Update platform, theme and plugins	Weekly	You, with a backup first
Delete unused plugins and accounts	Monthly	You
Restore a backup to a test location	Quarterly	You or your host; a developer if unsure
Two-factor on the five core accounts	Once, then when staff change	You
Confirm the certificate renews itself	Once, then monitor	You or your host
Review DNS records and registrar lock	Twice a year	You; a developer if the records are confusing
SPF, DKIM and DMARC	Once, check yearly	Developer or your email provider's guide
Access review	Quarterly	You
Uptime, certificate and login alerts	Set once, read when they arrive	You

When to do it yourself, and when to call someone

Items three, five, seven and most of eight are genuinely yours to do. They are about accounts and decisions, not code, and nobody knows who should have access to your business better than you.

Updates, backups and certificates are where people get stuck, because they recur and the failures are quiet. If you will do them weekly and test a restore every quarter, you do not need anyone. If you already know you will not, that is what a maintenance plan is for; I describe what one should include in what website maintenance includes.

If you would rather have someone look once and tell you where you stand, a site and security review is $250, credited toward any follow-up work. Most of what my Security+ training is good for here is knowing which of these eight things matter for your particular site.