Website security is something every business owner should take seriously. A compromised website can result in lost information, interrupted services, damaged customer trust, and potentially expensive repairs.
Over the years, I’ve worked with websites that have experienced security problems, including outdated software, compromised administrative accounts, malicious code, and vulnerabilities introduced through poorly maintained plugins.
While no website can be guaranteed to be completely secure, there are several precautions that can substantially reduce the risk of an attack.
The good news is that most small business websites don’t require elaborate security systems or expensive software subscriptions. What they do need is proper configuration, routine maintenance, reliable backups, and some common-sense precautions.
Following are seven important areas that website owners and developers should consider.
1. Keep Your Website Software Updated
One of the most important security measures is keeping your website’s software current.
If your website uses a content management system (CMS) such as WordPress, Joomla, or Drupal, updates are periodically released to improve functionality, maintain compatibility, and correct security vulnerabilities.
For WordPress websites, this includes three primary areas:
- WordPress Core: The application that powers the website.
- Themes: The software that controls the website’s design, layout, and certain functionality.
- Plugins: Additional software that provides features such as contact forms, galleries, SEO tools, and appointment scheduling.
Outdated plugins and themes are particular concerns because vulnerabilities can remain accessible to attackers long after a security update has become available.
It’s also important to remove plugins and themes that are no longer needed. Simply deactivating an unused plugin doesn’t necessarily eliminate its security risks. If the files remain on the server, vulnerable code may still be accessible.
When selecting new software, consider whether the developer provides regular updates, supports current versions of the CMS, and has an established history of maintaining the product.
Updates should also be approached carefully. Occasionally, a plugin or theme update can introduce compatibility problems. I recommend maintaining a recent backup before making significant changes and checking the website afterward to ensure everything continues to function correctly.
WordPress provides additional recommendations in its official Security Administration Guide.
2. Protect Your Website’s Administrative Access
Another common security concern involves weak or compromised login credentials.
Someone who gains access to your website’s administrative account may be able to modify pages, install software, access stored information, or introduce malicious code.
For this reason, website administration accounts should use strong, unique passwords that aren’t shared with other services.
A password manager can help generate and securely store complex passwords, eliminating the need to remember them individually.
Whenever possible, enable multifactor authentication (MFA). This requires an additional method of verification beyond the password, such as an authenticator application or security key.
It’s also important to limit who has administrative access.
For example, someone responsible for publishing blog posts doesn’t necessarily need permission to install plugins, change website settings, or manage other users.
Most content management systems provide different user roles that allow access to be restricted according to each person’s responsibilities.
Some additional precautions include:
- Avoid sharing administrative usernames and passwords.
- Create individual accounts for people who need website access.
- Remove accounts belonging to former employees or service providers.
- Use the lowest permission level necessary for each user.
- Review administrative accounts periodically.
- Protect your hosting and domain registrar accounts with equally strong security.
For business owners who rarely access their website’s administration area, these precautions are especially important. An account that hasn’t been used for months may still provide an opportunity for unauthorized access.
The Federal Trade Commission’s Cybersecurity for Small Business resource provides additional guidance on passwords, authentication, and protecting business accounts.
3. Maintain Reliable Website Backups
Even with appropriate security measures in place, problems can occur. Software updates may fail, files can be accidentally deleted, hosting equipment can experience problems, and websites can become compromised.
Having a reliable backup can make the difference between a relatively straightforward restoration and a costly redevelopment.
For WordPress and other database-driven websites, a complete backup generally needs to include both the website files and its database.
The files contain the themes, plugins, images, and other resources used by the website. The database contains much of the page content, settings, and other information required for the website to function.
Backing up only one of these may leave you without everything needed for a complete restoration.
Some important considerations include:
- Automatic Backups: Schedule backups rather than relying entirely on someone to remember to create them.
- Backup Frequency: A website that’s updated daily may require more frequent backups than one that changes only occasionally.
- Separate Storage: Maintain at least one backup outside your primary hosting account. If the hosting account is compromised, backups stored on the same account may also be affected.
- Multiple Restore Points: Retain more than one backup so you can recover an earlier version if a problem isn’t discovered immediately.
- Restoration Testing: Periodically confirm that your backups are usable and that the website can be restored successfully.
Many hosting companies provide automated backup services, which can be convenient. However, you should understand how often backups are created, how long they’re retained, and whether they’re included in your hosting plan.
It’s also important not to confuse server redundancy with backups. A hosting company may maintain multiple servers to reduce downtime, but this doesn’t necessarily provide a clean copy of your website from before a security incident.
For additional information, see the official WordPress Backup Guide.
4. Use HTTPS and Secure Connections
When visiting a website, you’ve probably noticed that its address begins with HTTPS rather than HTTP.
HTTPS uses encryption, typically provided through a TLS certificate, to help protect information transmitted between a visitor’s browser and the website.
This is particularly important for websites that collect information through contact forms, account logins, appointment scheduling, or online purchases.
Today, HTTPS should be considered a standard requirement for business websites, even those that don’t process payments or collect sensitive information.
Fortunately, many hosting companies provide TLS certificates at no additional cost, along with options for automatic renewal.
However, an HTTPS connection doesn’t mean that a website itself is secure from hacking. It protects information while being transmitted, but it doesn’t correct vulnerable plugins, compromised passwords, or insecure website code.
Secure connections are also important when administering a website.
For example, developers frequently use file transfer programs to upload or modify website files. Whenever possible, these transfers should use SFTP or another properly configured encrypted connection rather than traditional unencrypted FTP.
Similarly, website administration and hosting control panels should be accessed through secure HTTPS connections.
The important distinction is that encryption protects information in transit, while other security measures are necessary to protect the website and its stored data.
5. Choose Reputable Hosting and Understand Its Security Responsibilities
Your hosting provider plays an important role in website security, but there’s often confusion about what the hosting company is responsible for and what remains the responsibility of the website owner.
Generally speaking, a reputable hosting company should maintain the security of its server infrastructure, operating systems, and underlying hosting environment.
However, if your website uses WordPress or another CMS, the hosting company may not be responsible for keeping your installed themes, plugins, and custom website code updated.
These responsibilities depend on the hosting plan and whether managed website maintenance is included.
When evaluating hosting, some important considerations include:
- Regular updates to server software and security systems.
- Protection against common network attacks.
- Secure account administration and file transfer options.
- Reliable backup and restoration services.
- Availability of current, supported versions of PHP and other required software.
- Responsive technical support when problems occur.
- Clear explanations of which security services are included.
Some website owners assume that a virtual private server (VPS) or dedicated server is automatically more secure than shared hosting.
That isn’t necessarily true.
A properly managed shared hosting environment can provide adequate protection for many small business websites. Conversely, a VPS or dedicated server that’s poorly configured or inadequately maintained can introduce serious security risks.
With unmanaged VPS hosting, much of the responsibility for server updates, configuration, monitoring, and security may fall on the account holder.
For most small businesses, I would place more importance on the hosting provider’s reliability, security practices, and support than on purchasing a more expensive hosting plan simply because it offers greater server resources.
WordPress discusses these shared responsibilities in its Website Security Hardening Guide.
6. Use Security Monitoring and Protection Tools
In addition to keeping software updated and protecting administrative access, it’s useful to have systems in place that can identify suspicious activity.
For WordPress websites, security plugins and hosting services may provide several forms of protection.
These can include:
- Website Firewalls: Help identify and block certain malicious requests before they can exploit website vulnerabilities.
- Malware Scanning: Checks website files and other resources for known malicious code or suspicious changes.
- Login Protection: Helps limit automated attempts to guess administrative passwords.
- File Monitoring: Identifies unexpected changes to important website files.
- Security Alerts: Notifies the website administrator when potentially important problems are detected.
- Form Spam Protection: Helps reduce automated submissions through contact forms and other public-facing forms.
Keep in mind that form spam protection isn’t the same as protection against website intrusion. A service that prevents automated contact form submissions doesn’t necessarily protect against vulnerable software or unauthorized administrative access.
Similarly, installing multiple security plugins isn’t automatically better than using one properly configured and maintained solution.
Many hosting companies already provide firewall protection, malware scanning, or other security features. Before purchasing additional software, I recommend checking which protections are included with your hosting plan.
Another useful resource is Google Search Console, which provides a Security Issues report when Google detects certain problems, including hacked content and malware.
It’s important to understand that a clean report doesn’t guarantee that your website is secure. However, Search Console can provide an additional opportunity to identify problems that might otherwise go unnoticed.
Google explains these features in its Guide to Preventing Malware Infections.
7. Protect the Computers and Email Accounts Used to Manage Your Website
Website security doesn’t end with the hosting server.
Even a properly configured website can become vulnerable if someone gains access to the computer or email account used by its administrator.
For example, malicious software installed on a computer may capture login credentials or other sensitive information. Phishing emails can also trick website owners into providing passwords or approving fraudulent account access requests.
Business email accounts are particularly important because they’re frequently used to recover passwords and receive security notifications from hosting companies, domain registrars, and website administration systems.
If someone gains control of an important email account, they may be able to request password resets for other services associated with that address.
To reduce these risks:
- Keep your computer’s operating system, browser, and other software updated.
- Use reputable security software and maintain appropriate device protection.
- Enable multifactor authentication on important email and business accounts.
- Be cautious about unexpected attachments, links, and software downloads.
- Don’t provide website or hosting credentials in response to unsolicited emails.
- Verify unexpected security notices directly with the service provider.
- Avoid sharing administrative accounts among multiple people.
One concern I’ve encountered is emails that appear to come from a familiar web developer or hosting provider, requesting payment or administrative access.
These messages can be convincing because they may include the correct business name, logo, or other publicly available information.
If you receive an unexpected request involving your website or business accounts, contact the person or company through a communication method you already trust before taking action.
Security precautions are most effective when they protect not only the website but also the people and accounts used to manage it.
How Much Website Security Do You Actually Need?
Not every website requires the same level of security.
A relatively simple informational website will generally have different requirements from an e-commerce website that processes payments, maintains customer accounts, or stores sensitive information.
Similarly, a website with numerous third-party integrations, custom applications, or multiple administrators may require more extensive monitoring and security management.
For most small business websites, a good starting point is to ensure that software is maintained, administrative access is protected, backups are reliable, and appropriate hosting and monitoring services are in place.
More specialized websites may benefit from professional security assessments, additional safeguards, and more frequent monitoring.
There’s also the question of ongoing maintenance costs.
While website security is an ongoing responsibility, that doesn’t necessarily mean every small business needs an expensive monthly security subscription. Some businesses may require frequent maintenance, while others can be adequately supported through periodic reviews, timely software updates, and reliable automated protection.
The important thing is to understand what’s being maintained, which protections are provided, and what responsibilities remain with the website owner.
Final Thoughts
Website security involves more than installing a security plugin or choosing a reputable hosting company.
It’s a combination of appropriate software maintenance, secure account management, reliable backups, encrypted connections, monitoring, and protecting the computers and email accounts used to administer the website.
No security system can eliminate every possible threat. However, following these basic practices can reduce many common risks and make it easier to recover when problems occur.
If you’re uncertain whether your website has adequate protection, ask your web developer or hosting provider to review your existing security measures. A good assessment should identify any significant concerns, explain which protections are already in place, and recommend improvements that are appropriate for your website.
The goal isn’t to purchase every security product available. It’s to establish sensible, reliable protection that meets your business needs without unnecessary complexity or expense.
