How do you keep a small business website secure?

What attacks on small sites actually look like

Small businesses often assume nobody would bother attacking them. In practice, most attacks are not personal. Automated tools scan huge numbers of websites for weak passwords, outdated software and known holes, and take over whatever they find. Other attacks target people rather than software, with emails designed to trick someone into handing over a login or paying a fake invoice.

The consequences for a small business are practical: a site that shows spam or redirects visitors elsewhere, a domain flagged as unsafe by browsers, email that stops reaching customers, or money paid to a fraudster. The good news is that a few basic habits stop most of this.

Logins: passwords, two-factor and access

Use a password manager

Every account connected to your website should have a long, unique password: the website admin, hosting, domain registrar, email, payment provider and any connected tools. Nobody can remember dozens of those, which is why a password manager matters. It generates and stores passwords, fills them in for you and warns about reuse.

Turn on two-factor authentication everywhere

Two-factor authentication means a stolen password alone is not enough to log in. An authenticator app or a hardware key is stronger than codes by text message, but any second factor is far better than none. Start with the accounts that could do the most damage: your domain registrar and your email, because whoever controls those can reset almost everything else.

Give everyone their own login

Shared logins make it impossible to know who did what and hard to remove access when someone leaves. Give each person their own account with only the permissions they need. When a staff member, freelancer or agency stops working with you, remove their access the same day.

Certificates and updates

A security certificate encrypts the connection between visitors and your site and gives you the padlock and the https address. Without it, browsers mark the site as not secure and forms can expose what people type. Most hosts provide certificates and renew them automatically; confirm that yours does, and that every version of your address, with and without www, redirects to the secure version.

Out of date software is the most common way into self-hosted sites. If your website runs on a system such as WordPress, update the core software, theme and plugins promptly, remove plugins you no longer use, and avoid plugins that are no longer maintained. Hosted website builders patch their own platform, which removes much of this work. Our guide to website maintenance covers the routine in more detail.

Backups you can actually restore

A good backup turns a disaster into an inconvenience. Check these points:

• What is included: files, database, uploaded images and form entries.
• How often backups run, and how far back they go. A hack is sometimes discovered weeks later, so a single recent copy may already be infected.
• Where they are stored: at least one copy should be separate from the website's own server.
• How to restore: try it once, ideally on a test copy, so you know the steps before you need them.

Keep your own copy of the important things too: your text, photos, logo files and a list of customers or enquiries. If you ever change provider, you will want them.

Phishing and fraud aimed at website owners

Website owners receive a particular set of scam emails. Learn to recognise them:

• Fake domain renewal notices that look official but come from a company you never registered with, asking you to "renew" at an inflated price or to transfer your domain.
• Fake security warnings claiming your site has been hacked or will be suspended, with a link to a login page that steals your password.
• Invoice fraud, where a supplier's email appears to announce new bank details.
• Fake copyright complaints with an attachment or link "showing the infringing image".

The defence is a habit: never log in through a link in an email. Open the provider's site yourself or use your saved bookmark. Confirm any change of bank details by phone, using a number you already had. Our guide to choosing a domain name explains how domain registration works, which makes fake renewal notices easier to spot.

Protecting your email domain also makes it harder for criminals to send messages that appear to come from you. The records involved are explained in our guide to professional email on your own domain.

National cybersecurity agencies across Europe publish free, practical guidance for small organisations, and the EU Agency for Cybersecurity, ENISA, has material aimed at small businesses. They are worth a look for training staff.

What to do if your site is hacked

1. Stay calm and do not delete anything yet; you may need evidence of what happened.
2. Change the passwords for the website admin, hosting, domain and email, from a device you trust, and turn on two-factor authentication if it was off.
3. Contact your host or platform. They can often identify the cause and help restore a clean backup.
4. Restore from a backup made before the problem began, then update all software before putting the site back online.
5. Check for unknown admin users, unfamiliar files and changed redirects.
6. If personal data may have been exposed, check your obligations under the GDPR. Some breaches must be reported to the data protection authority within a short deadline; read your national authority's guidance or speak to an adviser.
7. Once fixed, request a review in search engine webmaster tools if your site was flagged as unsafe.

A ten-minute security check

• Two-factor authentication is on for domain, email, hosting and website admin.
• No shared logins; former staff and suppliers have been removed.
• The site loads with https and the padlock on every page.
• Software and plugins are up to date, or your platform handles this.
• You know where backups are and have tested a restore.
• Everyone who handles email knows not to log in through links.

If you would rather not manage servers at all, our website builder runs on hosting in the EU with the security certificate handled for you, which leaves you to look after the human side: passwords, access and a healthy suspicion of urgent emails.

Frequently asked