Guide
Website security basics for small businesses
The essential security practices for a small business website: accounts and two-factor authentication, updates, backups, forms and spam, HTTPS, third-party scripts and what to do if hacked.
VAULT 33|27 · Updated 12 November 2026 · Reviewed 12 November 2026 · 1 min read
The essentials
| Area | What to do |
|---|---|
| Accounts | Every person has their own login. Strong unique passwords and two-factor authentication on the domain registrar, hosting, website admin, email and analytics |
| Ownership | The business owns the domain and every account, with at least two trusted people able to access them |
| Updates | Platform, theme and plugins kept up to date; remove anything unused |
| Backups | Automatic, stored separately from the website, and tested by restoring occasionally |
| HTTPS | Everywhere, with HTTP redirecting to HTTPS |
| Forms | Spam protection, validation, and no sensitive data sent by plain email where it can be avoided |
| Third-party scripts | Only what you need, from providers you trust |
| Monitoring | Uptime alerts and Search Console security alerts switched on |
The UK's National Cyber Security Centre publishes a free small business guide covering backups, passwords, phishing and devices. It is a good checklist for the whole business, not only the website.
The domain is the crown jewel
If someone takes control of your domain, they control your website and email. Lock the domain at the registrar, use two-factor authentication, and keep the renewal card and contact email current.
If you think you have been hacked
- Do not panic, and do not delete everything.
- Change passwords for hosting, website admin and registrar, and turn on two-factor authentication.
- Check Search Console for security issues.
- Restore from a clean backup or have the site cleaned, then fix how it happened.
- Once clean, request a review in Search Console if Google flagged the site.
Who is responsible
Decide who checks updates, backups and alerts each month. Unowned security tasks do not get done. See website maintenance.
Sources
Open your vault.
A free systems audit of your business: where enquiries leak and exactly what we would build.
Book your free audit