Quick answer: Website security for a small business site starts with boring habits done on schedule: keep CMS, plugins and server packages updated; limit who can log in and how; use HTTPS everywhere; keep tested backups; scan for malware; and watch for odd traffic or file changes. Fancy tools help later. Basics prevent most common break-ins.
Why small sites get targeted
Attackers automate. They scan the open web for known CMS versions, weak passwords, outdated plugins and open admin paths. Your company size rarely matters. A brochure site can become a spam relay, a phishing host or a foothold into email and customer data.
Treat security as operations, not as a one-time project after a scare.
Checklist overview
Use this as a monthly pass:
- Software updates applied (or scheduled)
- Admin accounts reviewed; unused users removed
- Strong unique passwords and two-factor where available
- HTTPS with a valid certificate; HTTP redirects to HTTPS
- Offsite backups tested for restore
- Malware and integrity scan clean
- Firewall or host protections reviewed
- Forms and file uploads limited
- Error logs checked for repeated auth failures
- Incident contact and restore steps written down
The rest of this guide expands each area in plain language.
Keep the stack updated
Outdated WordPress cores, themes and plugins are a frequent entry point. So are neglected Node apps, forgotten staging sites and old PHP versions on shared hosting.
- Turn on update notices you actually read
- Patch security releases quickly; batch minor updates on a fixed day
- Remove plugins and themes you do not use
- Prefer well-maintained extensions over abandoned ones with “one more feature”
For WordPress specifically, login hardening and role hygiene matter as much as updates. See WordPress login security and our broader WordPress security guide.
Staging helps: test updates on a copy before production when the site takes payments or custom code.
Control access like it is money
Every admin user is a key to the building.
- One person, one account (no shared “company” logins)
- Least privilege: editors should not be administrators by default
- Remove contractors when projects end
- Change passwords after staff turnover
- Prefer passphrases or a password manager over short complex strings people reuse
Where the platform supports it, enable two-factor authentication for administrators. Our note on WordPress two-factor authentication walks through common options. Also review website admin passwords for policy ideas that teams will actually follow.
Lock down hosting panels, FTP/SFTP and database tools the same way. A perfect CMS password does not help if the hosting panel uses Welcome123.
HTTPS is non-negotiable
Encrypt traffic between browsers and your site. Visitors expect the padlock. Search engines have preferred HTTPS for years. Mixed content (HTTP images on HTTPS pages) still confuses browsers and users.
If you are still migrating, follow a careful cutover so rankings and bookmarks survive. Our HTTPS migration article covers redirects and Search Console steps. Certificate type choices (domain validation versus extended validation) are a separate decision; the baseline is a valid cert with automatic renewal.
Disable old protocols your host still allows when you can. Legacy SSL issues have bitten sites before; staying current with TLS settings is part of hygiene.
Backups you can restore
A backup that never restored is a hope, not a plan.
- Automated daily (or more often for stores) offsite copies
- Retention long enough to recover from a delayed malware discovery
- Periodic restore test to a staging URL
- Credentials for backup storage stored separately from the site
Know whether your host backs up the server and whether that includes database plus files. Many “managed” plans still leave restore responsibility partly with you.
Malware scanning and file integrity
Use host tools, a reputable security plugin, or an external scanner on a schedule. Watch for:
- Unexpected PHP files in uploads
- Modified core files
- New admin users you did not create
- Outbound spam complaints
If you find malware, clean is not only deleting odd files. Rotate passwords, update everything, restore from a clean backup if needed, and check webhooks and cron jobs attackers leave behind.
Firewall and host-level protections
A web application firewall (WAF) can block common exploit patterns and abusive bots before they hit your app. Hosting panels and CDN products often include a basic WAF toggle. For context on what a WAF does and does not do, see our web application firewall overview.
Also confirm:
- Directory listing disabled
- Sensible PHP and execution limits in upload folders
- SSH keys instead of passwords when you use shell access
- Separate staging from production with different credentials
Forms, comments and uploads
Contact forms and comment sections attract bots.
- Rate-limit or challenge suspicious submissions
- Validate file types and sizes on the server, not only in the browser
- Store uploads outside executable paths when the platform allows
- Moderate comments; close them on old posts if they only attract spam
Ecommerce and membership sites add payment and personal data risk. Card data should never sit in your WordPress database if a proper gateway can handle it. PCI scope is its own topic; treat checkout plugins as high-sensitivity software.
Monitoring without a security operations center
Small teams can still watch:
- Uptime checks with email or SMS alerts
- Failed login spikes
- Disk space and traffic anomalies
- Certificate expiry warnings
- Search Console security messages
Create a one-page incident note: who to call at the host, where backups live, how to put a maintenance page up, and how to tell customers if data might be affected. Write it before you need it.
Policies that reduce human error
Most breaches involve people as much as software.
- Phishing awareness for anyone with admin access
- No installing random plugins from email pitches
- No exporting full customer lists to personal laptops without need
- Clear ownership for monthly security checks
Put the checklist on a recurring calendar invite. Security that depends on remembering is security that slips.
What “good enough” looks like for a brochure or small store site
You do not need enterprise SIEM tools on day one. You do need:
- Current software
- Tight access
- HTTPS
- Restorable backups
- A scan-and-respond habit
- A WAF or host shield if your host offers one
- A written restore path
Add penetration testing and formal audits when you handle sensitive regulated data or when customers contractually require them.
FAQ
Will a security plugin alone protect WordPress?
No. Plugins help with scanning, login limits and hardening, but updates, hosting and passwords still matter. A plugin is one layer.
How often should we scan?
Daily automated scans are common for business sites. Investigate alerts the same day when possible.
Is shared hosting too risky?
Reputable shared hosts with isolation, automatic updates and backups can be fine for small brochure sites. Higher traffic or stricter compliance may need VPS or managed WordPress hosting. Match hosting to risk, not only to price.
What is the first step after a hack?
Take the site offline or into maintenance if it is actively harming visitors, rotate credentials, restore or clean with a professional if you are unsure, and document what changed. Then patch the hole that let them in.
Make security a monthly habit
Website security is mostly discipline: updates, access control, HTTPS, backups, scanning and light monitoring. Do those well and you avoid most automated attacks that hit small business sites. If you want help hardening a CMS or custom stack, see our Turn visitors into customers web and CMS work.
