How to secure your website: a security checklist for small businesses

How to secure a website: start with how sites get hacked

Before working through the list, it helps to know what you're defending against. Small business websites are rarely attacked by someone who has chosen them. They're found by automated scripts that scan thousands of sites for known weaknesses:

• Out-of-date software: a plugin, theme or CMS version with a published vulnerability.
• Weak or reused passwords: bots try common passwords and credentials leaked from other breaches.
• Abandoned access: old admin accounts, former agencies' logins, forgotten FTP accounts.
• Insecure hosting: shared servers with poor isolation, or old PHP versions.

Once in, attackers typically add spam pages, redirect visitors to scam sites, inject malicious code or use your server to send spam. You often find out when Google flags the site or customers report something odd.

So learning how to secure a website is mostly about closing those doors, and knowing quickly if one opens.

The website security checklist

The rest of this guide explains each one.

1. HTTPS on every page

HTTPS encrypts traffic between visitors and your site, and browsers flag pages without it as "Not secure".

• Install a valid SSL/TLS certificate. Most hosts provide free certificates that renew automatically.
• Redirect all http traffic to https.
• Make sure every image, script and font loads over https, or you'll get mixed content warnings.
• Watch the expiry date if renewal isn't automatic. An expired certificate shows a full-page browser warning that stops most visitors.

If you already have a warning, see our guide to fixing a site that says "not secure".

2. Keep everything updated

Updates fix known vulnerabilities, and once a vulnerability is published, automated attacks follow quickly.

• Update the CMS core, plugins and themes as soon as security releases come out. Turn on automatic updates for minor and security releases where your platform supports it.
• Delete what you don't use. An inactive plugin can still be exploited. If it's switched off, remove it.
• Avoid abandoned plugins. Before installing one, check when it was last updated and whether it's compatible with your CMS version.
• Test major updates on a staging copy if your site is complex, but don't let testing delay security fixes for weeks.

3. Lock down logins

• Two-factor authentication (2FA) on every account that can change the site: CMS admins and editors, hosting control panel, domain registrar and DNS provider. If someone gets a password, 2FA stops them using it.
• Strong, unique passwords stored in a password manager. Never reuse the website password anywhere else.
• Limit login attempts to slow down automated guessing.
• Don't use "admin" or your business name as a username.

4. Review who has access

Access tends to accumulate: a former employee, a freelancer from three years ago, the agency that built the site.

• List every user in the CMS, hosting account, domain registrar and any FTP/SFTP accounts.
• Remove anyone who no longer needs access.
• Give each person the lowest role that lets them do their job. Content writers rarely need administrator rights.
• Make sure the business, not an individual or agency, owns the domain and hosting accounts.

5. Back up, and test the restore

Backups are what turn a disaster into an inconvenience.

• Daily backups of files and database, more often if your site changes frequently.
• Stored off the server, ideally with a separate provider, so a compromised or failed server doesn't take the backups with it.
• Keep several weeks of history, because a hack is sometimes discovered weeks after it happened.
• Test a restore every few months. A backup you've never restored is a guess.

6. Choose secure hosting

• Use a supported PHP version (or equivalent for your platform). Old versions stop getting security fixes.
• Look for a host that offers a web application firewall, malware scanning, automatic SSL and isolation between accounts.
• Use SFTP or SSH, not plain FTP.

7. Add a web application firewall

A web application firewall (WAF) filters malicious traffic before it reaches your site, blocking common attacks and many bots. It's offered by most security plugins, many hosts, and content delivery networks.

8. Protect forms and uploads

• Add spam protection (such as reCAPTCHA, Turnstile or a honeypot field) to every form.
• If forms accept file uploads, limit file types and size, and store uploads outside the publicly accessible folder where possible.
• Keep form plugins updated; they're a common target.

9. Monitor so you find out first

• Search Console: the Security issues report tells you if Google has detected hacked content or malware. Google also emails verified owners.
• Uptime monitoring: an alert if the site goes down.
• File change and malware scanning: many security plugins and hosts offer this.
• Watch for signs: unfamiliar pages in Google results (search site:yourdomain.com), unexpected redirects on mobile, new admin users, or a sudden traffic spike to pages you don't recognise.

WordPress security checklist

WordPress powers a large share of business websites, which makes it a frequent target. The core software is well maintained; most problems come from plugins, themes and logins. On top of the list above:

• Automatic updates on for core minor releases, and for plugins you trust
• Every plugin and theme from a reputable source, actively maintained; no "nulled" (pirated) premium plugins
• A reputable security plugin or host-level protection for login limits, firewall and scanning
• File editing in the dashboard disabled (DISALLOW_FILE_EDIT in wp-config.php)
• XML-RPC disabled if you don't use it
• Database table prefix not left as the default, on new installs
• Correct file permissions as recommended in the WordPress hardening guide
• Administrator accounts kept to the minimum

Website security best practices, month by month

If you've already been hacked

Don't start deleting files. Follow the steps in our guide to fixing a hacked website: contain it, restore from a clean backup or clean the site, close the hole that let the attacker in, then ask Google for a review.