Small business website security: the basics that stop attacks

Most small-business websites that get hacked were not singled out. A script found them. This guide covers the basics that stop nearly all of those attacks, in plain English, plus a step-by-step plan for the day something goes wrong and a checklist you can work through in an afternoon.

Why small sites get attacked

Owners often tell us “nobody would bother hacking a small salon.” True, and irrelevant. Nobody is bothering; the attacks are automated.

Bots scan the whole internet, around the clock, looking for sites running a plugin with a known hole, a login page that accepts a weak password, or a form that can be abused. When they find one they break in, with no human involved, and use the site for whatever pays: sending spam, hosting phishing pages, redirecting your visitors to scams, or stealing customer details.

The only question that matters is whether you are easier to get into than the site next door.

The first two basics: HTTPS and updates

HTTPS and the padlock

HTTPS (the padlock in the address bar) means the connection between visitor and site is encrypted. Without it, anything typed into your contact form crosses the internet in plain text, and browsers label your site “Not secure”.

Every site needs it, and it should be free: any decent host issues and renews the certificate automatically at no cost.

What the padlock does not do is tell you the site is safe. It is an encrypted pipe, nothing more. A hacked site with HTTPS still shows the padlock. Treat it as the first basic, not the whole job.

Updates: the one that matters most

In our experience, out-of-date software is behind most small-business hacks. A hole is found in a popular plugin, a fix is released, and within a day or two the bots are scanning for every site that has not applied it.

On WordPress there are three layers to keep current:

• WordPress core. Minor security releases usually install themselves. Check that automatic updates are actually turned on.
• Themes. Including the one you are not using. An inactive theme is still code on your server.
• Plugins. This is where most holes are. Check at least weekly and apply security updates straight away.

Then remove what you do not use. Every plugin is a door, and a deactivated one is a door with the lock still in it. If you have not used it in six months, delete it, along with old themes and abandoned form plugins.

Hand-built sites have far less of this: no plugins to patch, and the host keeps the server current. It is one reason we lean that way for brochure sites, as explained in WordPress vs a custom website.

Logins: passwords, two-factor and fewer admins

Passwords and a password manager

Bots try thousands of passwords a minute against WordPress login pages. “Salon2024!” does not survive that. Neither does a strong password you also use elsewhere, because when another site leaks it, the bots will try it on yours.

The fix is boring and works: use a password manager (Bitwarden, 1Password and the ones built into Apple and Google devices are all fine), let it generate a long random password for every account, and never type one from memory again.

And change the default “admin” username; otherwise the bots already know half of what they need.

Two-factor authentication

Two-factor authentication (2FA) means a password alone is not enough to log in; you also need a code from your phone. It turns a stolen password from a disaster into a nuisance.

Switch it on in four places:

1. Your email account. Everything else resets through it. If someone gets into your email, they own all of it.
2. Your website login. On WordPress, a small 2FA plugin does this. On a custom site, ask your developer.
3. Your hosting account. This is where the backups, the files and the database live.
4. Your domain registrar. Whoever controls the domain controls where your site and email point. Losing it is worse than losing the site.

The hosting and domain accounts are the ones people forget, and the ones that can take your business offline completely. We covered them in do you own your website? If you are not sure who holds those logins, find out this week.

Backups you have actually restored

Backups are the safety net under everything else here. If something gets through, a clean backup turns a rebuild into a restore.

But a backup only counts if three things are true:

• It runs automatically, daily at least, hourly if you take orders or bookings.
• It is stored somewhere other than the site’s own server. If the server is compromised or dies, a backup sitting next to it goes with it.
• You have test-restored it. Once. Ever. To a staging copy or a temporary subdomain, to prove the files and database come back and the site works.

That last point is where most backup plans fall over. A backup that silently failed months ago looks exactly like one that works, until you need it. Ask your host to show you a restore, or do one yourself. Our hosting guide has the full list of questions to ask.

Keep at least 30 days of history, because some problems go unnoticed for a fortnight.

Fewer admin accounts

Every administrator login is another password that can be guessed, phished or left on a sticky note. Most sites need one or two, not eight.

Go through your users list. Remove anyone who has left, including the designer from three years ago. Give staff who only write posts or update prices an Editor or Shop Manager role, not Administrator. And give each person their own login, so you can remove one without changing everyone’s password.

Forms, bots and security headers

Contact-form spam and bot protection

Form spam is not just annoying. Unprotected forms get used to pump thousands of messages through your server, which can get your domain blacklisted and your real enquiries sent to junk.

Two approaches; you can use both:

• A honeypot. A hidden field that humans never see but bots fill in. Any submission with that field completed is thrown away. Invisible to your visitors, free, and surprisingly effective. This is what we build into most of our forms.
• reCAPTCHA or similar. Google’s reCAPTCHA, hCaptcha or Cloudflare Turnstile verify that a human is submitting. Modern versions rarely show a puzzle. The trade-off is a third-party script on your page and a line in your privacy policy.

Security headers, briefly

Security headers are a few lines of server configuration that tell browsers how to behave on your site: always use HTTPS, do not let the site be embedded in someone else’s page, do not run scripts from unapproved places. They change nothing visible, take a developer about half an hour, and close off a class of attacks aimed at your visitors rather than your server. A free online “security headers” scanner will grade yours; A or B is good, F means nobody has set them up. Ask your developer or host.

If you are hacked: what to do, in order

Signs include visitors being redirected to odd sites, a red warning in Google, spam sent from your domain, pages you did not create, or a login that suddenly fails. If that happens, work through this list in order.

1. Take the site offline or put it into maintenance mode. Stop it harming visitors and stop the attacker using it. A plain holding page is fine. Your host can do this in minutes.
2. Change every password. Website admin, hosting control panel, database, FTP, domain registrar and your email. Assume all of them are known. Turn on 2FA anywhere it is missing.
3. Restore from a clean backup. Pick one from before the first sign of trouble, not the most recent, since recent backups may include the attacker’s files. This is where tested backups with 30 or 90 days of history earn their keep.
4. Find the hole and close it. Usually an out-of-date plugin or a weak password. Update everything, remove what you do not need, and check for user accounts you did not create. Restoring without fixing the cause means it happens again next week.
5. Tell your customers if their data was exposed. If the site stored names, emails, addresses, booking details or anything else personal and the attacker could have reached it, people have a right to know. Be plain and prompt about it.
6. Report to the ICO if required. Under UK GDPR, a personal-data breach that is likely to result in a risk to people must be reported to the Information Commissioner’s Office within 72 hours of you becoming aware of it. Not every hack qualifies (a defaced homepage with no customer data behind it probably does not), but assess it and keep a written record of what you decided and why.

How WebProud hosting handles this

Most of the above is work someone has to keep doing. If you would rather it was not you, that is what managed hosting is for.

On our Standard hosting (£20 a month, £35 combined with a Standard build), SSL is free and renewed automatically, security updates are applied for you, and daily off-site backups are kept for 30 days. Support is next business day.

On Premium hosting (£75 a month), backups run hourly and are kept for 90 days, the site is monitored in real time so we usually know about a problem before you do, and support responds within an hour, 24/7. That suits shops and booking systems, where an hour offline costs money.

Either way, you own the site, domain and data, and hold your own logins.

The checklist, and where to start

Work through this once, then repeat the update and review items monthly.

• HTTPS on every page, certificate renewing automatically.
• WordPress core, themes and plugins up to date (check weekly).
• Unused plugins and themes deleted, not just deactivated.
• Long random passwords from a password manager, nothing reused.
• Default “admin” username gone.
• Two-factor authentication on email, website, hosting and domain accounts.
• Automatic off-site backups, daily or hourly, with at least 30 days of history.
• One backup test-restored, with the date written down.
• Admin accounts reviewed; leavers removed; one login per person.
• Contact form protected with a honeypot, a captcha, or both.
• Security headers set (ask your developer; aim for A or B on a scanner).

If you only do three things today: turn on 2FA for your email, update your plugins, and find out when your site was last backed up. That alone puts you ahead of most sites the bots will scan tonight.

Launching something new? Our website launch checklist covers the security items to tick before going live. And if you would like us to take the ongoing part off your hands, see our pricing or get in touch for a free 20-minute scoping call. We reply within one working day.