Small business owners often assume nobody would bother attacking their website. They are right that nobody is targeting them personally. The trouble is that most attacks are not personal at all. Automated scripts scan millions of websites every day, looking for an outdated plugin, a weak password or an unprotected form. If your site has one, it gets found.
The good news is that a few sensible measures stop the vast majority of these attacks. Here is what matters, in order of importance.
Keep everything up to date
Outdated software is the most common way in. Every website runs on code written by someone else, and that code receives security fixes when problems are discovered. Once a fix is published, the weakness it closes becomes public knowledge, and automated scans start looking for sites that have not updated.
If your website uses WordPress or a similar system, that means the core software, the theme and every plugin. Plugins that are no longer maintained should be replaced, because nobody will fix their next weakness.
Use strong passwords and two-step sign-in
Every account connected to your website is a door: the hosting, the domain registrar, the email, the website's admin area, the payment provider. Use a different, long password for each one, kept in a password manager, and switch on two-step verification wherever it is offered. A stolen password alone is then not enough to get in.
Also check who still has access. Former staff, a developer you worked with years ago, a freelancer who helped once: remove anyone who no longer needs to be there.
Protect your forms
Contact and booking forms are a favourite target for spam bots, and a form that is abused can get your emails marked as spam everywhere. Good protection is invisible to real visitors:
- a hidden field that people never see but bots fill in;
- a limit on how many messages one connection can send per minute;
- a background check that scores how likely a visitor is to be human;
- a size limit on what can be submitted.
These are standard on every website we build, with the per-minute limits set at the hosting level so abusive traffic is turned away before it even reaches the form.
Make sure the padlock is there
The padlock in the browser means the connection between your visitor and your website is encrypted. Without it, browsers show a warning, and anything typed into a form could be read along the way. Most good hosting includes a certificate and renews it automatically, but it is worth confirming that every version of your address, with and without www, loads securely.
Keep backups you can actually restore
If the worst happens, a recent backup turns a disaster into an inconvenience. Back up the website and any data it stores, such as bookings or customer records. Keep at least one copy somewhere separate from the website itself, and test a restore now and then. A backup that has never been restored is a hope, not a plan.
Know when something goes wrong
Monitoring tells you about problems before your customers do. Uptime monitoring checks every few minutes that your site responds. Error monitoring records when something breaks for a visitor. Without either, a hacked or broken site can go unnoticed for weeks.
Do not forget the human side
Many breaches start with an email, not with code: a fake invoice, a "your domain is expiring" message, a login page that looks real. Be suspicious of urgent requests to sign in or pay, and check the sender and the address in the browser before typing a password.
A short checklist
- Software, theme and plugins up to date.
- Unique passwords and two-step sign-in on every account.
- Old users removed.
- Forms protected against spam.
- Secure connection on every version of the address.
- Regular backups, stored separately and tested.
- Uptime and error monitoring switched on.
If you are not sure who looks after these on your current website, that is the first thing to find out. Every website on our Care Plan gets all of them as standard, so security is one less thing on your list.