Website security basics for a small business
Updates, strong unique passwords, two-factor login, fewer plugins, backups, HTTPS and access rights: simple habits that make a small website safer.
Small business websites are rarely attacked by someone who has chosen them personally. Most attacks are automated and look for sites with outdated software or weak passwords. That is good news, because the basics are not complicated. Here is what I would do, without any drama.
Keep everything updated
A website runs on software: a system, plugins, themes and libraries. Updates often fix security holes that are already publicly known, so a site that is never updated is an easy target. Someone should be responsible for updating it, either you or the person who maintains the site. An update can occasionally break something, which is why a backup comes first.
Passwords and two-factor login
- Every account gets its own long password, never reused.
- A password manager remembers them for you, so you only remember one main password.
- Turn on two-factor authentication (a code from an app, or a security key) for the site admin, hosting, domain registrar and email. Those accounts are the keys to everything. If a service offers an authenticator app, it is a better choice than SMS.
Fewer plugins, fewer problems
Every plugin is extra code that has to be kept up to date. Install only what you really use, choose plugins with a good track record and recent updates, and delete what you no longer use rather than just switching it off.
Backups
- A regular copy of both the files and the database.
- Stored somewhere other than the same server.
- You know how to restore it, and you have had someone try it once.
- A fresh one before any bigger change.
HTTPS and access rights
- HTTPS encrypts the connection between the visitor and the site. Browsers show a padlock and warn visitors on sites without it. Make sure the certificate renews.
- Each person has their own account, not a shared password.
- Give only the rights people need: an editor does not have to be an administrator.
- When someone leaves or a collaboration ends, remove their access. Keep a list of who has access to what.
None of this guarantees that nothing will ever happen, but it removes the most common causes. What follows after a site goes live is in website after launch, and the question of who holds the accounts is in who owns your domain, hosting and code. If you would like to go through your own site, write to me.