How to keep a small business website secure

Almost nothing that happens to a small site is personal. Scanners work through address lists all day trying holes they already know about, which is why the work here is a short list rather than a budget.

Updates are most of the job

If your site runs WordPress, Joomla, Drupal, Shopify apps or anything else with plugins, updates are the security work. The holes those scanners try are mostly ones the software’s authors patched months earlier, so a current site is not on the list they are working from.

Put it in the calendar monthly. If a plugin has not been updated by its author in a couple of years, replace it, because unmaintained code does not get a patch when the next hole is found in it.

Fewer logins, and two-factor on all of them

The old web person, the intern who did the summer social media, the agency you left in 2023. Those accounts are usually still active, and usually the ones without two-factor.

One login per person, no shared passwords, and remove the account when somebody stops working with you.

A backup you have restored

Backups fail quietly. The plugin stops running, the disk fills, the file is a zero-byte placeholder, and nobody finds out until the day it matters.

Keep the backup somewhere other than the server it came from. Restore it once when you set it up, and again after any significant change to the site. How often after that depends on how much your site changes.

Ours is not a fair comparison, and it is worth saying why. This site has no CMS and no admin login: the pages are files in a git repository, and every deploy rebuilds the whole site from them, so the backup gets restored every time anything changes. Most sites cannot work that way. If yours keeps its content in a database, the test is the only thing standing between you and a bad surprise.

HTTPS, and nothing loading over plain HTTP

Certificates are free and automatic now. If your padlock is missing or the browser says “not secure”, ask your host to turn it on, and it usually takes minutes.

Watch for the half-finished version too: a secure page pulling one image or script over plain HTTP still trips a warning.

The domain is part of your security

The domain is the front door to both the site and the mail. Two things worth checking today: that the registrar lock is on, so the name cannot be transferred out quietly, and that the renewal notice is not going to an address nobody reads.

A lapsed domain does not just drop the website, it drops your email with it. Who holds it, and how renewals work, is covered in how to register a .bm domain.

Your contact form is a door as well

Two questions worth asking about every form on the site. Where do the submissions actually go, and can a stranger upload a file through it?

A form that emails a mailbox is straightforward. A form that also stores names, phone numbers and messages in a database somewhere is holding personal information, and PIPA applies to it.

If it does get hacked

Take it offline or put it behind a holding page first, because a compromised site keeps working for whoever broke in. Change every password from a computer you trust, not from the machine that may be part of the problem.

Restore from a backup you know predates the break-in, then close whatever let them in before you put it back up. A restored site with the hole still open is found again by the same automated sweep, usually within days.

If personal information was exposed, PIPA’s breach reporting applies, and there is no small-business exemption in it.

Card payments are a separate subject with its own checklist. If you take cards through Authorize.Net, work through the Authorize.Net security checklist. Email has its own short list too, in how to keep your business email secure.

Where to start

Updates, logins, backup. In that order, today, and the rest can wait for a quiet week. If you want somebody to go through your setup and tell you what is actually exposed, that is a conversation we have.