Most small business website security incidents don’t come from sophisticated targeted attacks — they come from a handful of missed basics that automated scanning tools find easily. Here’s the checklist we run.
HTTPS Everywhere, Not Just the Checkout Page
A valid SSL certificate covering the entire site — not just payment pages — is table stakes, both for security and because browsers now flag non-HTTPS sites as "not secure" to visitors.
Keep Everything Patched, Not Just the Core Platform
Plugins and third-party extensions are a more common attack vector than the core CMS itself — an outdated plugin with a known vulnerability is one of the most exploited entry points.
Enforce Strong Admin Credentials and Limit Access
Unique, strong passwords and two-factor authentication on every admin account, plus removing access for anyone who no longer needs it, closes off the most common way sites get compromised.
Maintain Real, Tested Backups
A backup that's never been tested for restoration isn't a real safety net — schedule regular backups and periodically confirm they actually restore correctly.
Monitor for Unauthorized Changes
File integrity monitoring or a security plugin that alerts on unexpected file changes catches a compromise early, before it escalates into something customers notice.
Frequently Asked Questions
How often should a security audit happen?
An annual audit is a reasonable baseline for most small business sites, with more frequent checks for anything handling payment or sensitive customer data.
What should we do if we suspect a breach?
Change all admin credentials immediately, restore from a known-clean backup if available, and audit for how the breach happened before bringing the site back online — restoring without understanding the cause just invites a repeat.