Website security checklist for small businesses

A hacked website can lose you customers, data and Google rankings. This website security checklist covers the basics every small business should have in place.

1. HTTPS everywhere

Every page should load over HTTPS with a valid certificate. Browsers warn visitors about sites without it.

2. Keep everything updated

Update your website platform, themes, plugins and server software regularly. Old software is the most common way in for attackers.

3. Strong logins and two-factor authentication

• Use long, unique passwords for every admin account
• Turn on two-factor authentication (2FA) wherever possible
• Remove accounts for people who no longer work with you

4. Limit admin access

Give each person only the access they need. Never share one admin password across the team.

5. Regular backups — and test them

Keep automatic backups in a separate place and try restoring one now and then. Follow the 3-2-1 backup rule.

6. Protect forms from spam and attacks

Use spam protection on contact and order forms, and check what data your forms accept.

7. Watch for problems

Set up uptime monitoring and alerts for unusual logins or changes.

8. Protect customer data

Collect only the data you need, store it securely, and never store full card numbers yourself.

When to get a professional check

If you take payments, store customer data or have been hacked before, an expert security review or penetration test is worth it.

Frequently asked questions

### How do I know if my website was hacked? Signs include strange redirects, new admin users, unknown files, spam pages in Google or a warning from your host.

### Is a small website really a target? Yes. Many attacks are automated and scan every site for known weaknesses.

Want your website checked? See our cybersecurity service or request a free quote.