Website security for small businesses, the checklist
Ten steps to protect your business website against the most common attacks. No IT department needed and a manageable amount of effort.
Many small business owners think: “My website isn’t interesting to hackers.” Unfortunately that is not true. Most attacks are fully automated. Programs scan the internet around the clock for websites with known vulnerabilities, no matter who owns them. A hacked site is then abused for spam, phishing or spreading malware.
This checklist closes the most common doors.
Software and access
1. Install updates promptly. Outdated software is the most common cause of hacked websites. This applies especially to WordPress, its plugins and themes. Turn on automatic updates wherever possible and check at least once a month.
2. Delete unused plugins. Every plugin is additional code that can contain vulnerabilities. Deactivated plugins are still on the server. Delete what you don’t need.
3. Strong, unique passwords. A separate, long password for each of these: the website admin login, the hosting customer area, the domain provider and the FTP account. Use the password checker to see whether a password you have used has already appeared in a data breach.
4. Turn on two-factor login. For the website login and especially for hosting and domain access. Anyone who gets in there can take over your entire website and your email.
5. Only the users you need. Former employees, the old agency, an intern from three years ago: delete accounts that are no longer needed and give everyone only the permissions they need.
Connection and server
6. HTTPS everywhere. The whole website should only be reachable over HTTPS, and http:// should redirect automatically. The SSL checker shows whether your certificate is valid and when it expires.
7. Set security headers. A few lines in the server configuration protect visitors against clickjacking, injected code and unencrypted connections. Check your status with the security headers check and follow the instructions in Security headers explained.
8. Don’t reveal version numbers. Many servers announce in their headers which software is running in which version. That makes it easier for attackers to look for matching vulnerabilities. The headers check points this out.
For emergencies
9. Regular backups, stored elsewhere. A backup that only sits on the same server is often lost along with it after an attack or a server failure. Back up your website and database automatically and keep at least one copy somewhere else. Test once that you can actually restore the backup.
10. Set up monitoring. If your site is hacked or goes down, you want to be the first to know, not hear it from a customer. A monitoring service alerts you as soon as the site is unreachable or the certificate is about to expire. More in Website monitoring.
Signs that you have been hacked
- Your website redirects visitors to strange sites, often only when they come from Google or use a phone.
- Pages you never created appear in Google search results, often advertising medication or gambling.
- Google or your browser warns about your own website.
- Your host reports unusually high traffic or a lot of outgoing email.
- There are admin accounts you don’t recognise.
If this happens: change the passwords for all access points, inform your host and restore the website from a clean backup. If in doubt, get professional help. Hastily deleting individual files often does not remove every back door.
Start with the essentials
If you only do three things today, do these: install updates, turn on two-factor login for hosting and website, and set up an automatic backup. That protects you well against most automated attacks.