Website security checklist for small businesses: 15 steps that stop most problems

Website security for a small business comes down to a few habits: strong logins with two-step verification, up-to-date software, HTTPS, tested backups and removing what you do not use. You do not need a security team to do this. Most of it takes a morning to set up, and then a few minutes a month.

Attackers rarely pick you personally. Automated tools scan the web for old software and weak passwords, so small sites get hit too.

The 15-step checklist

Logins and access

• Use a long, unique password for every account
• Turn on two-step login for your website, hosting, domain and email
• Give each person their own account, with only the access they need
• Remove accounts of staff and vendors who have left
• Keep the domain and hosting logins in the business's name

Software

• Keep your website platform, theme and plugins updated
• Delete plugins and themes you do not use
• Avoid "free" pirated copies of paid themes and plugins, which can hide malware

Connection and data

• Use HTTPS on every page, with plain addresses redirecting to it
• Limit login attempts, and add a bot check to forms
• Collect only the personal data you need, and avoid storing card details yourself

Backups and monitoring

• Run automatic backups, stored away from the main server
• Test a restore at least once
• Set up uptime alerts
• Check Search Console for security issue warnings

Signs your site may be hacked

• Google shows strange titles or foreign-language pages for your site.
• Visitors get sent to other websites, sometimes only on phones.
• Browsers or Google show a warning.
• New admin users or files appear that nobody added.
• Your host warns you, or suspends the account.

The first hour after a hack

1. Stay calm and do not delete things yet. You may need the evidence to find how they got in.
2. Change passwords for hosting, website admin, database and email, and turn on two-step login.
3. Tell your hosting provider. They may be able to help with logs and scans.
4. Restore a clean backup, from before the problem started, if you have one.
5. Update everything, or the same hole lets them back in.
6. Ask Google for a review in Search Console if a security warning was shown.
7. Tell affected people if personal data may have been exposed, and get advice on your legal duties.

What you can check for free

How we handle this on our own site

On this website, owner accounts use two-step login, forms have a bot check, and sign-in attempts are limited. Backups run every night. None of this makes any site unhackable, and no honest provider will tell you otherwise. It does make an attack harder, and recovery quicker.

Common questions

Does an SSL certificate make my site secure?

It protects data travelling between the visitor and the site. It does not protect against weak passwords, old plugins or malware.

Is WordPress unsafe?

The core software is widely used and actively maintained. Most problems come from outdated plugins, weak passwords and poor hosting, so upkeep matters more than the platform name.

How often should I back up my website?

Match it to how often the site changes. A store with daily orders needs at least daily backups. Keep several past copies, so that you can go back to before a problem began.

Next step

Would you rather not think about any of this? Our care, hosting and security plans start at ₹999 a month. If you suspect a problem now, contact us and tell us what you are seeing.