Website security for small businesses: what actually matters

Small businesses rarely get targeted by sophisticated attackers. They get hit by automated attacks: bots that scan thousands of sites for the same known weaknesses, such as an out-of-date plugin, a weak password or an exposed admin page.

That is good news. It means a handful of sensible choices prevents most of the damage. No site is ever “unhackable”, but a well-built one is not worth the bot’s time.

1. Use HTTPS everywhere

HTTPS encrypts what visitors send to your site, including contact forms. Browsers label sites without it as “Not secure”, which is a trust problem even before it is a security problem. Today it is free and automatic with any good host. If your site still loads over plain HTTP, fix that first.

2. Reduce what can break

Every plugin, theme, script and integration is code someone has to keep updated. Most compromises of small business sites come through outdated software that is attached to the site, rather than the site’s own pages.

• Remove what you do not use.
• Prefer fewer, well-maintained tools over many small ones.
• Ask whether a feature really needs a database or a login at all.

A site built from simple, pre-generated pages with no public admin panel has far fewer places for an attacker to get in. That is one reason we build most business websites that way.

3. Protect the logins

Stolen or reused passwords are the most common way into accounts.

• Use a password manager and unique passwords for the host, domain registrar, email and website admin.
• Turn on two-factor authentication for each of them, especially your domain registrar and email. Whoever controls those controls your business online.
• Give people only the access they need, and remove it when they leave.

4. Back up, and test the backup

A backup you have never restored is a hope, not a backup. Know where your site’s backups live, how often they run, who can restore them, and how long a restore takes. Keep at least one copy somewhere separate from your host.

5. Protect your forms from abuse

Contact forms attract spam and sometimes worse. Good protection is mostly invisible to real people: a privacy-friendly bot check, limits on how often one source can submit, validation of what arrives, and never showing technical errors to visitors.

6. Security headers and sensible defaults

Your server can tell browsers to be stricter: block unexpected scripts, refuse to be embedded in other sites, and avoid leaking information. These headers cost nothing to turn on and block whole classes of attacks. Ask your developer whether they are in place.

7. Know who owns what

A surprising number of incidents are really ownership problems: the domain is in a former developer’s name, the hosting account belongs to a freelancer who has disappeared, or nobody knows who can log in. You should own the domain, the hosting account, the code and the admin accounts, with your own 2FA on them.

8. Plan for the day something goes wrong

Decide in advance: who do we call, where are the backups, how do we put up a simple “back soon” page, and who tells customers? Five minutes of planning now saves hours of panic later.

A note on privacy

If your site collects names or emails, Québec’s privacy law (Law 25) sets expectations about how you handle that information and what you tell visitors. A plain, accurate privacy policy and collecting only what you need is a good start. For legal specifics, speak to a qualified professional.

What to ask your web provider

• Who owns the domain, hosting and code?
• How are backups done, and when was one last restored?
• How are updates handled, and by whom?
• Is two-factor authentication on for every admin account?
• What happens if the site goes down at 9 p.m.?

If those questions get vague answers, that is useful information.

Want a quick look at your current setup? Tell us about your site and we will give you a plain, practical review. You can also see how we approach websites and IT support.