Security: the basics a small business website needs

This page covers why the security of a small business website affects how it is found in search and how visitors come to trust it. It also sets out the basics an owner can check without a developer, in the order a reader would meet them. Security here means three things: the connection between a visitor and the site, the software the site runs on, and the copies of the site kept in case something goes wrong. Each of those can be checked from a browser or from the control panel a host provides. The page does not test or secure anyone’s site, and it does not claim to. It explains what to check and who to ask when the answer is no.

Why a hacked site loses more than its data

Search engines and visitors both judge a site by whether it is safe to use. A hacked site can show visitors a warning from their browser before any of its content appears, and that warning arrives at the worst possible moment. A compromised site can also fill its pages with material the owner never wrote, such as hidden pages or links to unrelated products. Either outcome can cost the traffic that search brought in, and recovering from it usually takes longer than the original fix. The problem is rarely dramatic at the start. It often begins with an outdated piece of software, a weak password or a backup that nobody has ever tested.

Worth knowing

Three gaps come up often enough to check first: phishing, a weak vendor and an unprotected email domain. The FTC’s guide covers each of them in plain terms. More at the FTC’s Cybersecurity for Small Business.

The people and the warnings behind a secure site

A business owner standing at an office window with a coffee mug — Who can log in to the site is a decision for the owner, and it should be written down.

An empty modern office with rows of desks and tall windows — When nobody is working on the site, its software still needs updates.

Access is the first thing to review, because every account that can edit the site is a way in. List who holds a login, including former staff, freelancers and any agency that built the site. Remove the accounts nobody uses, and give each remaining account its own password rather than a shared one. Most hosts and site platforms offer two-step sign-in, and it is worth switching on for every account that can edit the site. A visitor meets the other side of security through the browser, so load the site in a private window once a month and look at what a first-time visitor sees.

Basics worth checking on your own site

Does the address start with https?

A site should load over an encrypted connection, which shows as https and a padlock in the address bar. Every page should do this, not only the home page, because one plain page can undermine the rest. Check it by loading a few inner pages and reading the address bar each time. If a page loads over plain http, ask the host or builder to redirect it and to confirm the certificate is valid. A certificate that has expired shows a warning to every visitor until it is renewed.

Is the software up to date?

Out-of-date platforms, themes and plugins are a common way in for automated attacks. Check for updates at least once a month, and treat any security update as urgent. Remove themes and plugins you no longer use, since unused code is still code that can be attacked. Keep a short note of what was updated and when, so that a fault can be traced later. If a third party looks after the site, agree in writing who applies updates and how quickly.

Is there a backup you could actually restore?

Keep a copy of the site and its database somewhere other than the server it runs on. Most hosts take backups, but a backup held only by the host is one copy in one place. Test a restore once, on a copy, because an untested backup is a guess. Note how often the backup runs and how far back it goes. Ask for both answers in writing before you need them.

Has spam appeared on the site that you did not write?

Search for your domain with site: in Google to see which pages the search engine has indexed. Pages, links or products you do not recognise are a sign that something has been injected into the site. Check the site from a private window and look for links you did not place. If you find any, do not ignore them, because the material can reach the search results. Report it to the host or to whoever maintains the site without delay.

None of these checks needs a developer, but each one needs an owner who knows the answer. Keep the list in one place and go through it once a quarter, or sooner after any change to the site. A site that passes the checks above can still be attacked, so the aim is to make the basic failures unlikely, not to promise safety. Where a check fails and the cause is unclear, ask the host or builder for the specific fault rather than a general assurance. The FTC guide linked above sets out the same basics for any small business that runs a website or hires a vendor. For questions about this guide itself, the Reach Out page explains what to write about.