Website security has a reputation problem. It sounds like something that concerns banks and government departments, not a five-person business in Sydney. Then a small business site gets compromised, starts serving spam pages to Google, gets flagged as dangerous in Chrome, and suddenly security is the only thing that matters.
The good news is that the overwhelming majority of small business website compromises are not sophisticated attacks. They are automated scripts exploiting the same handful of basic gaps, which means the same handful of basic protections stop most of them.
1. HTTPS everywhere, with no exceptions
An SSL certificate encrypts traffic between your visitor and your site, puts the padlock in the browser bar, and has been a Google ranking signal for years. There is no excuse for a site without it in 2025: certificates are free through Let's Encrypt and are included automatically by modern hosts.
The detail people miss is consistency. Every version of your domain should redirect to the single secure version. If your site loads over both secure and insecure connections, or shows mixed-content warnings because images load insecurely, the padlock breaks and so does visitor trust.
2. Updates, applied on a schedule
If your site runs WordPress or any CMS with plugins, outdated software is the single most common way in. Attackers do not find your site personally. They scan the entire internet for sites running a plugin version with a known hole, and they do it within days of the hole being published.
The fix is boring and effective: core, theme, and plugin updates applied on a regular schedule, with a quick check afterwards that nothing broke. If nobody in your business owns that job, it will not happen, which is why ongoing care is part of every website engagement we take on. It is also one of the honest arguments for a static site, which we cover in static websites versus WordPress: with no plugins and no database, most of this attack surface simply does not exist.
3. Backups you have actually tested
A backup you have never restored is a hope, not a plan. Good practice for a small business site looks like this:
- Automatic backups at a frequency that matches how often the site changes. Daily for a site with forms and content updates, weekly at minimum for a brochure site.
- Backups stored somewhere other than the hosting server itself, so a compromised server does not take the backups with it.
- A restore test at least a couple of times a year, so you know the process works and how long it takes.
4. Strong access, fewer keys
Most compromises that are not software holes are simply weak or reused passwords. The rules are the same as everywhere else: long unique passwords stored in a password manager, and two-factor authentication turned on for your hosting account, your domain registrar, and your CMS admin.
Just as important is limiting who has access at all. Old developer accounts, a former staff member's admin login, the agency you stopped working with two years ago: every leftover account is an unlocked side door. Audit the user list twice a year and remove anyone who no longer needs to be there.
5. Security headers and a firewall
A small set of HTTP security headers tells browsers to enforce protections on your behalf: forcing secure connections, blocking your site from being embedded in hostile frames, and restricting where scripts can load from. They cost nothing at build time and most sites simply never set them. A web application firewall, offered by services such as Cloudflare, adds another automated layer that filters known attack traffic before it ever reaches your site.
6. Forms that do not become a spam cannon
Contact forms are a favourite target. Without protection, bots will use them to flood your inbox or, worse, relay spam through your domain and damage your email reputation. Server-side validation, rate limiting, and a modern invisible anti-bot check keep forms usable for humans and useless for scripts. When we build lead capture into client sites, this protection sits in the serverless function that processes the form, not just in the browser where it can be bypassed.
The five-minute self-check
- Does the padlock show on every page of your site, with no warnings?
- Do you know when your CMS and plugins were last updated?
- Could you restore your site from a backup today, and who would do it?
- Does anyone still have admin access who should not?
- When you submit your own contact form, does anything check that you are human?
If any answer makes you uncomfortable, that is the place to start. Our free AI Site Audit includes a check of the security fundamentals visible from the outside, and takes less time than making a coffee.
