The small business website security checklist

Small business website security comes down to a handful of habits: protect every login with strong passwords and two-factor authentication, keep software updated, keep tested off-site backups, use good hosting with HTTPS, and monitor the site so you know quickly when something goes wrong. Most compromises of small business sites come from automated attacks on weak passwords and outdated software, not targeted hacking.

Use the checklist below as a starting point. It's written for business owners, not security teams, and most items take minutes to put in place.

Why small sites get attacked

Attackers rarely pick small businesses by name. They run automated tools that scan the internet for known vulnerabilities and guess common passwords. A hacked site can be used to send spam, host phishing pages, inject malicious links or redirect visitors elsewhere. Beyond the cleanup cost, you risk search engines flagging your site, email providers blocking your domain, and customers losing trust.

The checklist

1. Accounts and logins

• Use a password manager and a unique, long password for every account.
• Turn on two-factor authentication (2FA) for website admins, hosting, domain registrar, DNS, email and any payment or CRM accounts.
• Give each person their own login. No shared admin accounts.
• Use the least privilege needed: editors don't need administrator rights.
• Remove former employees, contractors and agencies promptly.
• Make sure your business, not a vendor, owns the domain, hosting and email accounts.

2. Updates

• Apply security updates promptly for your CMS, themes and plugins (or apps and integrations on hosted platforms).
• Remove plugins and themes you don't use. Inactive code can still be exploited.
• Avoid "nulled" or pirated premium plugins and themes. They often contain malware.
• Prefer well-maintained plugins with recent updates and active support.
• Test larger updates on a staging site before applying them to the live site.

3. Backups

• Run automatic backups at least daily.
• Store copies off the hosting server, so a server problem doesn't take backups with it.
• Keep several weeks of history, in case a problem goes unnoticed for a while.
• Test a restore at least a few times a year.
• Back up before every significant update or change.

4. Hosting and infrastructure

• Choose a reputable host with isolation between accounts, a firewall and malware scanning. Our guide on choosing web hosting covers what to look for.
• Keep server software (such as PHP) on supported versions.
• Use a web application firewall (WAF), either from your host or a CDN provider.
• Use SFTP or SSH instead of plain FTP.

5. HTTPS and SSL

• Serve the entire site over HTTPS with a valid SSL/TLS certificate.
• Redirect all HTTP traffic to HTTPS.
• Confirm certificates renew automatically.

6. Domain and email

• Turn on registrar lock and 2FA at your domain registrar.
• Keep domain contact details current, and set domains to auto-renew.
• Set up email authentication records: SPF, DKIM and DMARC. They help stop others from sending email that pretends to be from your domain.

7. Forms and spam

• Protect forms with spam filtering or a CAPTCHA.
• Don't collect sensitive data (such as Social Security numbers or full card numbers) through basic website forms.
• Limit who receives form submissions, and use secure tools for anything sensitive.

8. Monitoring

• Set up uptime monitoring that alerts you when the site goes down.
• Use malware or file-change scanning.
• Verify your site in Google Search Console, which notifies you of security issues it detects.
• Review admin users and activity logs periodically.

9. A plan for when something goes wrong

• Write down who to call: your developer, host and domain registrar.
• Keep a list of every account the website depends on, and who has access (stored in your password manager).
• Know how to restore from backup and how long it takes.

Priorities if you only have an hour

Platform differences

Hosted platforms like Webflow handle much of the infrastructure, as we noted in when Webflow is the right call. But no platform can protect a reused password or an old employee's active login. Account security is always yours.

If you're on WordPress, your theme and builder choices affect your security surface too. Fewer plugins means fewer updates and fewer openings, one reason we favor lean builds in Elementor vs Divi vs Astra.

The short version

Lock down logins with unique passwords and 2FA, keep everything updated, keep tested off-site backups, use good hosting with HTTPS, set up email authentication and monitor the site. Those steps handle the large majority of risk for a small business website.

Want someone to handle this for you? Our care and security plans cover updates, backups and monitoring, or contact us.