Most attacks on small and medium business websites are not sophisticated. They target the same handful of weaknesses again and again. Fixing these basics stops the vast majority of problems.
The checklist
- HTTPS everywhere, with HTTP redirected to HTTPS automatically.
- Strong, unique admin passwords and two-factor authentication for every admin account.
- Updates applied promptly to the CMS, plugins, libraries and server.
- Login protection: limit failed attempts and never reveal whether a username exists.
- Least privilege: staff get only the access their role needs.
- Automatic off-site backups, tested by actually restoring one.
- Input validation on every form to block injection and spam.
- Security headers that stop clickjacking and content sniffing.
- No secrets in code: API keys and passwords live in environment settings.
- Monitoring: alerts for downtime, unusual logins and file changes.
The one people skip: restoring a backup
Many businesses discover their backups are incomplete only on the day they need them. Schedule a test restore at least twice a year.
Security is not a product you install once. It is a set of habits your team keeps.
Where to start
If you only do three things this week, turn on two-factor authentication, apply pending updates and confirm your backups restore. Those three alone close the doors most attackers try first.
