Introduction
A business website is reasonably secure when the software is up to date, logins are protected, backups exist and have been tested, and someone is watching for problems. Most hacked small business sites we're asked to clean up were not targeted. They were found by automated scans looking for an old plugin, a weak password or an exposed admin page, and broken into because one of those basics was missing.
Treat the fifteen checks below as an audit. None of them needs special tools, and most take a few minutes each.
Accounts and logins
1. Every admin account belongs to a current person
List every user with admin access to the website, hosting, domain registrar and any connected service. Remove former staff, old agencies and "test" accounts. Each person should have their own login, never a shared one.
2. Strong, unique passwords and a password manager
Reused passwords are how many sites get into trouble: a password leaked from another service is tried on your admin page. Use a password manager and a long, unique password for every account.
3. Two-factor authentication everywhere it's offered
Turn on two-factor authentication for the website admin, hosting control panel, domain registrar, email and any payment accounts. If someone steals a password, the second factor stops them.
4. Login attempts are limited
Automated tools try thousands of passwords against login pages. Limit failed attempts, and consider adding a CAPTCHA or moving the login behind extra protection. Many hosts and security plugins handle this.
Software and updates
5. The core software is current
Whether it's WordPress, another CMS or a framework, check the version against the latest release. Old versions with known vulnerabilities are exactly what automated scanners look for.
6. Plugins, themes and libraries are updated and trimmed
Every plugin or package is code someone else wrote. Update them regularly, remove anything you don't use (deactivated isn't enough; delete it), and avoid ones that haven't been updated in a long time. We'll cover a safe update routine later in this series.
7. The server software is supported
Ask your host which PHP or Node.js version your site runs on. Versions past their end of life no longer receive security fixes.
Connection and hosting
8. HTTPS is on everywhere
Every page should load over HTTPS, and http:// addresses should redirect to https://. Certificates from services like Let's Encrypt are free and renew automatically on most hosts.
9. Hosting accounts are separated
If several sites share one hosting account, one hacked site can infect the others. Separate important sites, or at least make sure each runs under its own user.
10. File permissions and exposed files are checked
Configuration files, backups and logs shouldn't be downloadable from the web. Old backup files such as site-backup.zip left in the public folder are a common leak.
Data and recovery
11. Automatic backups, stored off the server
Backups should run automatically, include both files and database, and be stored somewhere other than the server they protect. If the server is compromised or the host has a problem, backups kept on it go too.
12. A restore has actually been tested
A backup you've never restored is a hope, not a plan. Restore to a staging site at least once to prove it works and to know how long it takes.
13. Forms are protected and collect only what's needed
Contact and signup forms should have spam protection, validate what's entered, and collect only the data you need. Every extra piece of personal data you store is something you have to protect.
Free quote · reply within 24 hours
Want someone looking after your site 24/7?
Tell us what your site runs on. You get a fixed monthly quote in writing within 24 hours.
Monitoring and response
14. Someone is told when something changes
Uptime monitoring tells you when the site goes down. Google Search Console emails you if Google detects malware or hacked content. A security plugin or host-level scanning can flag changed files. Make sure these alerts go to a person who reads them.
15. You know what to do if it happens
Write down, in one place: who to call, where backups are, how to reach the host, and who has access to the domain. When a site is hacked, the first hour goes much better with that list ready.
How often to run this checklist
Updates and backup checks should happen at least monthly. Review user accounts whenever someone leaves or a contractor finishes. Run the full fifteen points a couple of times a year, or after any major change such as a redesign or hosting move.
Security questions owners ask
My site is small. Would anyone bother hacking it?
Most attacks are automated and don't care how big you are. Small sites are often used to send spam, host phishing pages or redirect visitors elsewhere.
Is a security plugin enough?
It helps, especially with login protection and file scanning, but it can't replace updates, good passwords and backups.
What does the padlock in the browser actually mean?
Only that the connection between the visitor and your server is encrypted. It doesn't mean the site itself is safe from hacking.
Conclusion
Put the monthly items in a calendar: updates, a backup check, a quick look at who has admin access. Security is mostly habit.
And if you'd prefer someone else to own the habit, that's what our maintenance plans are for.
Free quote · reply within 24 hours
Want a fixed price for your project?
Tell us what your site runs on. You get a fixed monthly quote in writing within 24 hours.