Website Security Basics Every Small Business Should Know

Many small-business owners assume attackers only go after big companies. In reality, a great deal of website hacking is automated: programs scan the web constantly for any site running outdated software or protected by a weak password, regardless of who owns it. A small site can be a target simply because it is there and unprotected.

A compromised website can send visitors to scams, display spam, capture information typed into forms, or be flagged with warnings in search results and browsers. Cleaning up afterward takes time and money, and the damage to customer trust can last longer than the hack itself.

The good news is that a handful of basic habits block many common problems. This guide covers them in plain English, drawing on guidance from CISA (the U.S. Cybersecurity and Infrastructure Security Agency), the OWASP Foundation and Google.

Keep everything updated

Software updates frequently fix security weaknesses. Once a weakness becomes publicly known, attackers can automate attempts to exploit it on every site that hasn't installed the fix. CISA lists updating software as one of four basic steps everyone should take to stay safe online.

For a website, "everything" includes:

• The content management system itself, such as WordPress, Joomla or Drupal.
• Every plugin, extension and theme you have installed.
• The server software and programming language versions, which your host may manage for you.
• The computers and phones you use to log in to the site.

Turn on automatic updates where they are available and reliable, and check regularly for anything that needs attention. Remove plugins and themes you no longer use, because inactive code can still contain weaknesses.

Strong passwords and two-factor authentication

Stolen or guessed passwords are a common way into websites, hosting accounts and email. CISA recommends using strong passwords, a password manager and multifactor authentication.

A strong password is long, unique to that one account, and not based on personal details. Since nobody can remember dozens of those, a password manager, an app that creates and stores passwords securely, makes good habits practical.

Two-factor or multifactor authentication adds a second check when you sign in, such as a code from an authenticator app, a physical security key or a prompt on your phone. Even if someone steals your password, they still can't get in without that second factor. Turn it on for your website login, your hosting account, your domain registrar and your email. Email is especially important, because whoever controls it can often reset the passwords for everything else.

Give each person their own login with only the access they need, and remove accounts promptly when staff members or contractors leave.

Backups you can actually restore

Backups are your safety net against hacks, accidental deletions, failed updates and hosting problems. A good backup setup has a few qualities:

• It runs automatically and regularly, often daily for sites that change frequently.
• It includes both the website's files and its database.
• At least one copy is stored somewhere separate from the website's own server.
• Several older versions are kept, in case a problem went unnoticed for a while.

Most importantly, test it. A backup that has never been restored is a hope rather than a plan. Ask your developer or host to walk you through a test restore so you know how long it takes and that it actually works.

Use HTTPS everywhere

HTTPS encrypts the connection between a visitor's browser and your website, so information such as contact form details and login credentials can't easily be read or altered along the way. Browsers show an indicator such as a padlock for secure connections and flag pages that aren't secure.

Google lists serving pages securely as part of a good page experience. Many hosts now include free certificates, often issued by the nonprofit Let's Encrypt, so cost is rarely a barrier. Make sure every page, not just checkout or contact pages, loads over HTTPS, and that the plain HTTP version of your address redirects to the secure one.

Choose plugins and themes carefully

Add-ons are a big part of what makes platforms like WordPress so flexible, and also a significant source of risk. The OWASP Top 10, a widely used awareness list of the most serious web application security risks, includes software supply chain failures in its 2025 edition. That category covers the danger of relying on third-party components that are vulnerable, outdated, unsupported or maliciously altered, and OWASP's advice includes obtaining components only from official, trusted sources.

Before installing anything, check that it comes from an official directory or a reputable developer, has been updated recently, and is actively supported. Avoid pirated or "nulled" copies of paid plugins and themes, which are a known route for hidden malicious code. The fewer add-ons you run, the fewer things you have to keep updated.

What to do if you're hacked

Warning signs include unfamiliar pages or links, redirects to other sites, warnings from Google or your browser, admin accounts you don't recognize, or a notice from your host. If it happens, stay calm and work methodically. Google's guidance for hacked sites follows broadly these steps:

1. Get help by contacting your hosting provider and, if you have one, your web developer.
2. Quarantine the site, for example by taking it offline temporarily, so it can't harm visitors.
3. Use Google Search Console to check for security issue reports about your site.
4. Assess the damage and identify how the attacker got in, such as an outdated plugin or a stolen password.
5. Clean the site, often by restoring a known-clean backup, then fix the weakness and change all passwords.
6. Request a review from Google if your site was flagged, so warnings can be removed.

Don't skip step four. If the original weakness isn't fixed, the site can be compromised again soon after it has been cleaned.

Key takeaways

• Many attacks are automated, so small sites are targets too.
• Keep your platform, plugins, themes and devices updated, and remove what you don't use.
• Use long, unique passwords, a password manager and two-factor authentication, especially for email and hosting.
• Keep automatic, off-site backups and test that you can restore them.
• If you're hacked, find and fix the cause, not just the symptoms, before requesting a review.

Sources

• CISA, Secure Our World
• OWASP Top 10:2025
• OWASP, A03:2025 Software Supply Chain Failures
• web.dev, Help, I think I've been hacked
• Google Search Central, Understanding page experience