Website Security Basics for Small Businesses

Small business websites are often targeted not because they are important, but because they are easy. Automated attacks look for outdated software, weak passwords and vulnerable plugins. A few basic habits prevent most problems.

Essentials

1. 1HTTPS everywhere. Use an SSL certificate and redirect all traffic to HTTPS.
2. 2Keep software updated. Apply CMS, theme and plugin updates promptly, after taking a backup.
3. 3Remove what you do not use. Old plugins, themes and test pages are common entry points.
4. 4Strong, unique passwords for every admin account, plus two-factor authentication where available.
5. 5Limit admin access. Give each person their own account with only the permissions they need, and remove accounts when people leave.

Backups

Keep automatic backups stored somewhere other than your web server, and test restoring them. A backup you cannot restore is not a backup.

Forms and spam

Protect contact forms with spam protection, validate inputs and avoid collecting sensitive data you do not need.

Hosting

Choose reputable hosting with firewall protection, malware scanning and regular server updates.

Monitoring

• Use uptime monitoring to know when the site goes down.
• Check Google Search Console for security issue notifications.
• Watch for unexpected admin users or file changes.

If your site is hacked

1. 1Take the site offline or into maintenance mode if it is harming visitors.
2. 2Change all passwords.
3. 3Restore from a clean backup or have the infection professionally cleaned.
4. 4Identify and fix the entry point, usually an outdated plugin or weak password.
5. 5Request a review in Search Console if Google flagged the site.

VENUS DIGITAL CORPORATION includes security updates, backups and monitoring in our website maintenance. See Web & Software and the maintenance checklist.