Guide
The website security checklist for small businesses
Website security for a small business comes down to six habits: strong logins with two-factor, regular updates, tested backups, HTTPS everywhere, careful plugins and a hosting provider that filters attacks. This checklist puts them in order, so you can work down it in an afternoon and then review it once a year.
At a glance
What a sensible baseline looks like
Why bother
Small does not mean safe
Many owners assume attackers only go after big names. In practice most attacks are automated. Software scans huge numbers of websites for known weaknesses and tries stolen passwords everywhere, with no human choosing a victim. A small business site with an outdated plugin is as easy to exploit as any other, and often easier because nobody is watching it.
The damage is also proportionally larger. A hacked site can lose you search rankings, get your email blocked as spam, scare away customers and cost days of lost income while you clean up. Business owners often have no spare time or IT department, which is exactly why a short, repeatable checklist beats a vague intention to be careful.
Nothing in this checklist needs deep technical skill. It needs a little time, a password manager and a habit of looking at the site every month.
Section 1
Accounts and logins
- Use a password manager and give every account a unique password of at least 14 characters
- Turn on two-factor authentication for email, hosting, domain and website admin accounts
- Give each person their own login, never a shared one
- Give staff and contractors the lowest role that lets them do the job
- Remove access the same day someone leaves or a contract ends
- Rename the default admin user and delete unused accounts
Section 2
Software and updates
- Update the website platform, plugins and themes at least weekly
- Remove plugins and themes you do not use, and old test sites
- Use only software from the official directory or the developer, never pirated copies
- Choose a supported PHP version in your control panel
- Check that the software you rely on is still maintained
Security that works in the background
Imunify360, a firewall, DDoS protection and CloudLinux isolation are included.
Rhythm
How often to do each job
| Task | How often | Time needed |
|---|---|---|
| Check for updates | Weekly | 10 minutes |
| Review users and admin roles | Monthly | 10 minutes |
| Take your own backup | Before big changes | 15 minutes |
| Test a backup restore | Twice a year | 1 hour |
| Check SSL and renewals | Quarterly | 5 minutes |
| Review forms and data you collect | Yearly | 1 hour |
| Review hosting plan and contacts | Yearly | 20 minutes |
Hosting
What your hosting should do for you
Good hosting takes a large share of the security work off you. Look for a firewall in front of your site, malware scanning, protection against DDoS floods, separation between accounts so a neighbour's problem is not your problem, free SSL, and backups that are stored away from the server itself.
Every plan with us includes Imunify360 malware scanning, a ModSecurity firewall, DDoS protection, CloudLinux isolation, free SSL and weekly remote backups kept for about a month, on servers in London. You can read the full list on our web hosting security page. These protections do not replace your own habits, but they close the gaps that individual owners find hardest to close.
Ask any provider what happens when something goes wrong, and how quickly you can reach a person. Live chat open 24/7 and a ticket system matter most at the moment you are worried.
Section 3
Backups and recovery
- Know exactly what is backed up, how often and where it is kept
- Keep at least one copy away from the server, following the backup guide
- Restore a backup to a test location twice a year
- Write down who to contact and how to restore, and keep it somewhere accessible
- Take a fresh backup before every major update or redesign
Priorities
Where to spend time first
High value, quick
- Two-factor on important accounts
- Updating plugins and themes
- Deleting unused plugins
- A password manager
- Checking backups exist
Valuable, slower
- Restore tests
- Reviewing user roles
- Reading your privacy notice against reality
- Training staff on phishing
- Planning an incident response
The law
Data protection and your website
If your site collects personal data, such as names and emails through a contact form or orders from a shop, UK data protection law applies to you. This is general guidance and not legal advice. The Information Commissioner's Office (ICO) website has free guidance written for small organisations, including how to decide whether you need to register and pay the data protection fee.
In practical terms, collect only what you need, tell people what you do with it in a privacy notice, keep it secure and delete it when you no longer need it. If a breach does happen, serious ones must be reported to the ICO within a short time limit, so know your plan before you need it. Our own approach is explained in our privacy policy.
Section 4
Site settings, forms and payments
- Force HTTPS on every page and keep your certificate renewing, see moving to HTTPS
- Protect forms against spam and keep form submissions out of public folders
- Use a trusted payment provider so card details never touch your server
- Limit login attempts and hide or protect the admin login page
- Keep file permissions tight and disable file editing in the dashboard
- Keep email authentication such as SPF, DKIM and DMARC in place, see the email guide
Incident
If something goes wrong
Change passwords
Hosting, admin, database and email first.
Contact support
Live chat (open 24/7) or a ticket, with a short description of what you see.
Restore a clean backup
From before the problem started, then update everything.
Find the cause
Otherwise the problem returns. See removing malware.
Tell the right people
Customers, the ICO or Action Fraud if the situation calls for it.
Yearly review
A yearly security review in one hour
Once a year, book an hour and walk through the whole list. Open the user list and remove anyone who no longer needs access. Confirm that two-factor is still on for the important accounts. Check the expiry dates of your domain and your certificate, and that the contact details on both are current, since reminders sent to an old address are a common cause of lapses.
Then restore a backup to a test location, read your privacy notice against what the site really collects, and ask yourself what you would do if the site disappeared tomorrow. Write the answer down in three lines and keep it where you can find it. That one page, with the support contact details, turns a panic into a procedure.
If the review shows work that you cannot do yourself, ask our live chat (open 24/7) or hire a developer for a fixed task rather than leaving it undone.
Do not forget email and phishing
Many website compromises begin with an email. Someone is tricked into entering a password on a fake login page or opening a harmful attachment. A short conversation with everyone who touches the site is worth more than another plugin: check the sender address, do not click urgent links, go to the real site by typing its address, and report anything odd.
Set up SPF, DKIM and DMARC so that criminals cannot easily send mail pretending to be your domain, and keep your own mailboxes protected with strong passwords and two-factor login.
FAQ
Common questions
Is a small business website a target for hackers?
Yes, mostly through automated attacks that look for outdated software and weak passwords. Size does not protect you.
How much does website security cost?
The basics cost little. Many protections are included with good hosting, such as a firewall, malware scanning and SSL. Our plans start at 84p a month (£10.03 billed yearly) when billed yearly.
Do I need a security plugin?
Possibly for login protection, but your hosting already provides scanning and a firewall. Avoid stacking overlapping tools.
How often should I review security?
Weekly for updates, monthly for users, and a full review of this list once a year.
What is the first thing to do?
Turn on two-factor authentication for your email, hosting and admin accounts, then update everything.
Keep reading
Related pages
Put the security checklist on solid hosting
Every plan includes a firewall, Imunify360 and free SSL.