A basic security checklist for small business websites

Many attacks on small business websites are not personal. Automated tools scan the internet day and night, looking for common weaknesses: outdated software, weak passwords, forgotten admin accounts. The good news is that a few basic measures close most of these gaps.

1. Use HTTPS everywhere

HTTPS encrypts the connection between your visitors and your website. It protects form data and passwords, and browsers mark sites without it as “Not secure”. Certificates are free with Let’s Encrypt, and most hosting providers can install one in a few clicks.

• Redirect every http:// address to https://.
• Enable HSTS, so that browsers always use the secure version.

2. Keep everything up to date

Most successful attacks use known security holes that already have a fix. Updates close them.

• Update your CMS, its plugins and its themes as soon as security updates are released.
• Remove plugins and themes you do not use: every extra component is one more thing to maintain.
• Ask your hosting provider which versions of the server software they run.

3. Protect every account

Your website is only as safe as the accounts that control it: hosting, domain name, email and the website’s admin panel.

• Use a different, long password for each account, stored in a password manager.
• Turn on two-factor authentication wherever it is available, starting with email and hosting.
• Remove the accounts of people who no longer work with you.

4. Back up, and test the restore

A backup you have never restored is a hope, not a plan. Aim for regular, automatic backups that are stored outside your hosting account.

• Follow the 3-2-1 rule: three copies of your data, on two different types of storage, with one of them in another location.
• Keep several versions, so that you can go back to a date before a problem started.
• Test a full restore at least once or twice a year.

5. Add security headers

Security headers are short instructions that your server sends to browsers. They block whole families of attacks, such as malicious scripts injected into a page or your site being shown inside another site.

• Content-Security-Policy: which scripts, styles and images the browser may load.
• X-Frame-Options or frame-ancestors: prevents clickjacking.
• X-Content-Type-Options and Referrer-Policy: simple, safe defaults.

You can check your website for free at securityheaders.com.

6. Collect less data

Data you do not collect cannot leak. Every form field, analytics tool and third-party plugin adds personal data that you have to protect under the GDPR.

• Ask only for the information you really need.
• Avoid tools that load content from other companies, unless they bring clear value.

7. Know what to do when something goes wrong

Write down, in one place, where your website is hosted, who has access, where the backups are and how to restore them. Add a free uptime monitor that sends you an email if the site goes down. On the day a problem happens, this page saves hours.

The checklist

1. HTTPS with redirects and HSTS
2. Software and plugins up to date
3. Unique passwords and two-factor authentication
4. Automatic backups, tested
5. Security headers
6. Only the data you need
7. A written recovery plan

Need help with one of these steps? We can review your website and give you a clear list of priorities, in plain language. See our IT & cybersecurity service.