Many small businesses assume attackers only go after large companies. In reality, smaller sites are often targeted precisely because they’re easier to break into. A hacked website can leak customer data, get blacklisted by search engines and damage trust that took years to build.
The good news: most attacks exploit the same handful of weaknesses. Here’s the checklist we run through with every client.
1. Use HTTPS everywhere
Every page should load over HTTPS, not just checkout or login pages. It encrypts data between your visitors and your site, and browsers now warn users away from sites without it. Services like Cloudflare provide free certificates that renew automatically.
2. Keep everything updated
Outdated plugins, themes, frameworks and server software are the most common way attackers get in. Turn on automatic updates where you can, and check monthly for anything that needs a manual update.
3. Use strong passwords and two-factor authentication
Every admin account, hosting panel, domain registrar and email account should have a unique, long password stored in a password manager. Turn on two-factor authentication wherever it’s offered, especially for your domain and DNS provider.
If someone takes over your domain account, they control your website and your email. Protect it like your bank account.
4. Give people only the access they need
Not everyone needs to be an administrator. Give team members and freelancers the lowest level of access that lets them do their job, and remove accounts as soon as someone leaves.
5. Back up automatically, and test your backups
Keep automatic daily backups stored somewhere separate from your website. Just as important: try restoring one every few months. A backup you’ve never tested is only a hope.
6. Put a firewall in front of your site
A web application firewall (WAF) blocks common attacks, malicious bots and traffic floods before they reach your server. Many CDN providers include a basic one on their free plans.
7. Protect your forms
Contact and sign-up forms are a favourite target for spam and abuse. Validate everything on the server, limit how often a form can be submitted, and add a bot check such as Cloudflare Turnstile.
8. Secure your email domain
Set up SPF, DKIM and DMARC records for your domain. They stop criminals from sending emails that pretend to come from your company, and help your real emails stay out of spam folders.
9. Collect less data
The safest data is the data you never stored. Only ask customers for what you truly need, and delete old records you no longer use.
10. Have a plan for when something goes wrong
Write down who to call, where your backups are and how to take the site offline if needed. Ten minutes of planning now can save days of panic later.
Need a second opinion?
Our team offers security reviews for websites and web applications, with a clear list of fixes ranked by priority. Get in touch to book one.