Website security basics for small businesses
The most common ways small business websites get hacked, and simple steps to protect your site, your customers and your reputation.
Most small business owners assume hackers aren’t interested in them. Unfortunately, most website attacks aren’t personal. Automated bots scan millions of sites looking for known weaknesses, and they don’t care whether you’re a bank or a bakery.
A hacked website can redirect visitors to scams, send spam from your domain, be flagged by Google with a warning, or simply disappear. Here’s how attacks usually happen and what you can do about them.
How small business sites usually get hacked
Outdated software
This is the most common way in. When a weakness is found in a popular plugin, theme or content management system, the fix is published, and so is the problem. Bots then search for sites that haven’t installed the update.
Weak or reused passwords
Admin logins are attacked constantly with lists of common and previously leaked passwords. If your website password is also used somewhere else that’s been breached, it may already be on one of those lists.
Too many plugins
Every plugin is extra code that needs updating and could contain a weakness. Abandoned plugins that are no longer maintained are a particular risk.
Shared logins and old accounts
Former staff, past developers and agencies sometimes still have access years later. Every account that isn’t needed is another way in.
Simple steps that make a big difference
1. Keep everything updated
Update your platform, themes and plugins promptly, ideally with automatic updates for security fixes. Delete plugins and themes you don’t use, rather than just deactivating them.
2. Use strong, unique passwords and two-factor authentication
Use a password manager to create a long, unique password for every account, and turn on two-factor authentication (2FA) wherever it’s offered. This applies to your website, but also to your domain registrar, hosting and email, which are just as important.
3. Review who has access
Give each person their own login, with only the access they need. Remove accounts for anyone who no longer works with you.
4. Use HTTPS everywhere
Your site should load over HTTPS, with the padlock in the browser, on every page. Browsers warn visitors about sites that don’t, and it protects information people type into your forms.
5. Keep backups
Make sure your site is backed up regularly, that backups are stored somewhere separate from the site itself, and that you know how to restore one. A backup you’ve never tested may not work when you need it.
6. Protect your forms
Contact forms attract spam and abuse. Basic spam protection and checking what people submit stop most of it.
7. Lock down your domain
Your domain name is the key to your website and email. Keep it registered in your business’s name, turn on auto-renew and registrar lock, and protect the account with 2FA. Losing control of your domain can be far harder to fix than a hacked website.
Why architecture matters too
Many attacks target the parts of a website that run on a server: the database, the admin login and the plugins. A site built as static pages and served from a CDN has far fewer of those moving parts on the live site, so there’s much less for bots to find.
That’s one reason we build with Astro and Cloudflare, with content managed in a separate headless CMS behind its own secure login. You still need good passwords and sensible access control, but there are no plugins on the live site to fall behind on. Our WordPress vs Astro comparison goes into more detail.
If your site has been hacked
- Change all passwords, starting with your hosting, domain and email accounts.
- Contact your developer or host straight away.
- Restore from a clean backup if you have one, then find and fix how the attacker got in.
- Check Google Search Console for security warnings, and request a review once the site is clean.
The Australian Cyber Security Centre also publishes free guidance for small businesses at cyber.gov.au.
Want a site that’s secure by design?
If keeping your current site patched feels like a second job, it might be time for a simpler setup. Run a free speed check to see how your site performs, or get in touch to talk about your options.