Website Security Basics Every Business Owner Should Insist On

Small business sites get hacked constantly, and almost never because anyone chose them. Bots scan the entire internet for known holes and take whatever opens. Which is good news, in a way: defending against opportunists is a solved problem.

The non negotiables

• Updates, applied on time. The overwhelming majority of compromises exploit vulnerabilities that were patched months earlier. Someone must own applying updates as a routine, not a resolution.
• Backups that restore. Daily, kept off the server itself, and actually tested. An untested backup is a wish. With real backups, most disasters shrink to an hour of inconvenience.
• Strong access hygiene. Unique passwords in a manager, two factor authentication on hosting and admin accounts, and access removed the day someone leaves. Shared logins in a text file remain the most common unforced error.
• HTTPS everywhere. Table stakes for browsers, search engines, and customers alike.
• Minimal software surface. Every plugin and extension is a door. Remove what you do not use; deactivated is not removed.

Signs of trouble worth knowing

Traffic that suddenly drops or spikes oddly, search results for your site advertising pharmaceuticals, browser warnings, customers reporting strange emails from you, or unexplained new admin accounts. Finding out from your own monitoring beats finding out from a customer, and both beat finding out from a blacklist.

If the worst happens

Isolate the site, restore from a clean backup, change every credential, and close the hole that let it happen, in that order. Cleaning an infection in place without finding the entry point is how sites get hacked twice, since the second visit is usually automated too.

None of this requires a security team. It requires ownership: one named person or vendor whose job includes updates, backups, and monitoring. That is precisely what a good maintenance arrangement buys, and it is far cheaper than the week you would otherwise lose.