Website security basics for small businesses

Most small business websites are not hacked because someone picked them out personally. They are hacked because automated tools scan the internet for outdated software, weak passwords and unprotected forms, and find them. A few steady habits block much of that.

Here is a practical checklist for owners, drawing on the Canadian Centre for Cyber Security's baseline guidance for small and medium organizations and on what we see in day-to-day website work.

Use HTTPS everywhere

HTTPS encrypts the data travelling between your visitor's browser and your site. Without it, browsers may label your pages as not secure, which is especially off-putting on pages with forms. Certificates are often included free with modern hosting, for example through Let's Encrypt.

• Make sure every page loads over HTTPS, not just the homepage
• Redirect old http addresses to https automatically
• Confirm certificates renew automatically, so a warning never appears out of nowhere
• Fix mixed content, meaning images or scripts that still load over plain http

Keep software updated

Outdated software is one of the most common ways in. On WordPress, that means core, themes and plugins. On other platforms, it means the framework, libraries and server software. The Canadian Centre for Cyber Security recommends turning on automatic updates where they are available, or running a proper patch management process.

Fewer moving parts means fewer things to patch. Remove plugins and themes you do not use, and be cautious with any plugin that has not been updated in a long time.

Lock down admin access

Your website admin, hosting account, domain registrar and business email are the keys to your business online. Protect them accordingly.

• Turn on two-factor authentication for every account that can change your site, hosting or domain. The Cyber Centre specifically recommends it for administrator and cloud accounts.
• Use a password manager and give every person their own login. Shared passwords make it impossible to remove one person's access cleanly.
• Give people the lowest level of access they need. Someone who writes blog posts does not need administrator rights.
• Remove access promptly when staff or contractors leave.
• Make sure your business, not a former contractor, owns the domain and hosting accounts.

Keep backups you have actually tested

Backups are your recovery plan for hacks, bad updates and accidental deletions. Canada’s Cyber Centre advises the same three habits: back up the information your business depends on, keep those copies somewhere separate and secure, and encrypt them so only a few people can open them.

• Back up both your files and your database, on a schedule
• Keep copies somewhere separate from your web host
• Keep several versions, so you can go back to before a problem started
• Test a restore now and then. A backup you have never restored is a hope, not a plan.

Protect forms and choose hosting carefully

Contact forms attract spam bots and, occasionally, attacks. Practical defences include:

• Spam protection, such as a hidden honeypot field, a challenge service like Cloudflare Turnstile or Google reCAPTCHA, or limits on how often one visitor can submit
• Checking and cleaning input on the server, not just in the browser
• Storing submissions securely and limiting who can see them, rather than sending sensitive details around by email

Hosting matters too. Look for a provider that keeps the server patched, offers a firewall, includes automatic backups and has responsive support. Budget shared hosting can be fine for a simple site, as long as you know what you are and are not getting.

Monitor so you find out first

The worst way to discover a problem is from a customer. Set up a few simple alerts and routines:

• Uptime monitoring that emails or texts you when the site goes down
• Google Search Console, which can notify you about security issues Google detects on your site
• Alerts for new admin accounts or unusual login activity, if your platform supports them
• A quarterly reminder to review users, plugins and backups

Decide in advance who you would call if something went wrong. If customers' personal information is affected, privacy law may require you to report the breach, so know where that guidance lives before you need it.

Our recommendation: block out an hour this month for this list. Turn on two-factor authentication everywhere first, since it takes minutes. Then confirm your backups exist and can be restored, and that updates are actually happening. If you cannot answer who owns your domain or when the last backup ran, that is your sign to find out, or to ask whoever manages your site to show you.

Written by Vishal Singh

Founder of Byte Harbor and a senior frontend and web platform engineer. He builds websites, custom software and AI automation for businesses across Canada and the US.

About Byte Harbor