Almost every conversation we have about website security with a small business starts in one of two places. Either nothing has happened yet and the topic feels theoretical, or something has happened and the questions are urgent and expensive. The gap between those two states is usually a handful of unremarkable tasks that nobody owned. This is a plain account of what actually threatens a small business site, what protection is worth paying for, and what to do in the hours after you find out something is wrong.
Website security for a small business comes down to a few basics done consistently: keep software patched, put two factor authentication on every admin account, keep tested off site backups, force HTTPS, and filter your forms. Most compromises exploit known, unpatched vulnerabilities rather than clever targeted attacks.
What actually goes wrong on small business websites?
Most compromises are not personal. Nobody picked your plumbing company out of a lineup. Automated scanners crawl the web looking for software versions with known holes in them, then exploit whatever they find at volume. Your site is a row in a list.
Four patterns cover the large majority of what we see when a small business calls us after something has gone wrong.
- Outdated plugins, themes and core software. A contact form plugin that has not been updated in two years is the most common way in on a WordPress site. The vulnerability is public, the patch already exists, and nobody applied it.
- Weak or shared admin credentials. One login passed around the team, a password stored in a shared doc, a contractor who finished the project in 2024 and still has full access, and no second factor on any of it.
- Form spam and abuse. Less dramatic, far more constant. Junk enquiries that waste sales time, contact forms hijacked to relay email, comment sections quietly filling with links to sites you would not want to be associated with.
- Card skimming on stores. Malicious JavaScript injected into a checkout page that copies card details as the customer types them. Hosted checkouts make this much harder. Self hosted stores carry more of the burden themselves.
Notice what is absent from that list. No sophisticated adversary, no zero day exploit. The boring failures do nearly all of the damage, which is good news, because boring failures are cheap to prevent.
Which risks deserve your attention first?
Security advice usually arrives as an undifferentiated list of thirty items, which is exactly why none of it gets done. Rank instead by what the failure would cost you against how much work it takes to close. Almost everything worth doing sits in the top half of this table.
| Risk | Likely impact if it happens | Effort | Typical cost |
|---|---|---|---|
| Outdated CMS, plugins, themes | Malware injection, defacement, search engine warnings | Low but ongoing | $50 to $250 a month inside a maintenance plan |
| No two factor on admin accounts | Complete site takeover | Low, one afternoon | Free to $10 a month |
| No off site backup | Days of downtime, permanent loss of content and orders | Low | $5 to $40 a month |
| Missing or half configured SSL | Browser warnings, abandoned forms, lost trust | Low | Free with most hosting |
| Unfiltered forms | Spam leads, wasted sales hours, email deliverability damage | Low to medium | Free to $30 a month |
| Shared or orphaned logins | Access you cannot revoke or audit | Low, a policy rather than a tool | Free |
| Cheap shared hosting with no isolation | Infection spreading from a neighbouring site | Medium, needs a migration | $20 to $100 a month more |
| No firewall or rate limiting | Automated exploit attempts reach your application directly | Medium | $20 to $200 a month |
| Custom code that trusts user input | Data exposure, database injection | High, needs a developer | Project cost |
| Card fields handled on your own server | Card theft, chargebacks, payment processor liability | High | Project cost, or move to a hosted checkout |
If your budget for this is a few hundred dollars a year, spend it on the first six rows and ignore the rest for now. That is not a compromise. That is where the actual risk lives.
Before recommending a single tool, we list every account with admin access to the site, the hosting, the domain registrar and the DNS. On a typical small business site that list contains at least two people who no longer work with the company. Removing them costs nothing and closes a real hole.
What does basic hardening actually involve?
Hardening sounds like a specialist activity. In practice it is a short sequence of decisions that hold for years once made.
- Take an inventory. Every plugin, theme, integration and third party script on the site, plus who installed it and whether anything still depends on it. Delete what is unused. Deactivated plugins still sitting on the server can still be exploited.
- Put every admin account behind two factor authentication, with no exceptions for the owner. Give each person their own login. Set roles so that the person who writes blog posts cannot install software.
- Lock down the login page itself. Rate limit attempts, block after repeated failures, and stop using predictable usernames like admin.
- Enable automatic updates for security patches, and schedule a monthly manual review for the larger version jumps that need testing first.
- Force HTTPS everywhere and check that no page still loads an image, font or script over plain HTTP.
- Add validation and a spam filter to every form, including honeypot fields and server side checks, not just a checkbox widget on the front end.
- Move payment capture to a hosted checkout or a payment provider iframe so card numbers never touch your server.
- Turn on off site backups with a tested restore path, then write down where they live and who can trigger one.
That list takes a competent developer a day or two on an existing site. It is the least glamorous work in website design and development and the work most likely to save you a very bad week.
Do your backups actually work?
Nearly every small business we talk to believes they have backups. Fewer than half can say where those backups are stored, how far back they go, or who has ever restored one. A backup you have not tested is a belief, not a plan.
Three questions settle it. Are the backups stored somewhere other than the server they protect, so that a compromised host does not take the copies with it? How many days of history do you keep, given that malware often sits quietly for weeks before it does anything visible? And has anyone restored one, end to end, into a staging environment, in the last six months?
For a store, add a fourth. Backups usually capture the database and files, but orders placed during a restore window can still be lost. Know what your recovery point actually is before you need it.
What does SSL actually protect?
SSL, or more precisely TLS, encrypts the connection between a visitor's browser and your server. It stops someone on the same public network reading what is typed into a form. That is worth having, and browsers now shame sites that lack it.
It does not verify that your business is legitimate, scan for malware, keep your plugins updated, or stop anyone logging in with a stolen password. A padlock on a compromised site is still a padlock. Treat SSL as a floor rather than a security programme, and be wary of anyone selling an expensive certificate as though it were protection. For most small businesses a free certificate from your host, renewed automatically, is the correct answer.
What should you do in the first 48 hours after a compromise?
Speed matters more than elegance here, and the instinct to quietly delete the bad file and hope is the wrong one. If you do not know how they got in, they are still in.
- Take the site offline or into maintenance mode. A defaced or infected page in front of customers costs more per hour than the downtime does.
- Change every password: hosting, CMS admin, database, FTP, registrar, and any connected email account. Revoke API keys and reissue them.
- Preserve evidence before you clean. Copy the current state of the site and the server logs somewhere safe. Once you overwrite it, you lose the ability to work out what happened.
- Restore from a backup taken before the earliest sign of compromise, not from yesterday's.
- Find the entry point. Compare file timestamps, read the access logs around the first symptom, and check which software version was running.
- Patch that specific hole, then bring the site back and watch it for a week.
- If card or personal data may have been exposed, talk to your payment processor and a lawyer about notification obligations before you talk to anyone else.
Search engines may have flagged the site while it was infected. Once it is clean, request a review through your search console so warnings clear rather than lingering in results and quietly suppressing traffic for months.
We keep an incident one pager for every site we maintain: where backups live, who to call at the host, the registrar login owner, and the last known clean restore point. It fits on one page and it turns a panicked afternoon into a checklist.
How much maintenance is enough?
For a brochure site with a handful of pages, monthly updates, quarterly backup restore tests and an annual access review will keep you out of trouble. For a store taking orders daily, move updates to weekly, monitor uptime and file changes continuously, and treat any checkout change as a security change.
The honest cost is somewhere between $50 and $400 a month depending on complexity, whether that goes to an agency, a freelancer or an hour of someone's internal time. Compare that with the alternative: a rebuild after a serious infection typically costs more than a year of maintenance, and the lost revenue while the site is down usually costs more again. If your site drives enquiries or sales, the maths is not close.
Security also intersects with things you already care about. Spam filtered properly means your sales team stops ignoring the inbox, which is a conversion optimization problem as much as a security one. A store that moves card capture to a hosted checkout usually gets a faster, better tested payment flow as a side effect, which is part of why Shopify development appeals to merchants who do not want to own that risk.
Frequently asked questions
How often should a small business update its website software?
Apply security patches within days of release. Most platforms can do that automatically, and you should let them. Larger version jumps that might break a layout or an integration need testing on a staging copy first, so review those monthly. If you take orders daily, move to a weekly cycle. A broken checkout costs more than the testing time ever will.
Is a security plugin enough to protect my site?
It helps. A good plugin adds a firewall, limits login attempts and scans for known malware. What it cannot do is patch outdated software, stop a password being reused, or restore a site it failed to protect. It also runs inside the application it is defending, so anything that compromises the server goes around it. Use one, but do not stop there.
What is the most common way small business websites get hacked?
Outdated plugins and themes, by a wide margin. Once a vulnerability is published, automated scanners hunt for that exact version across the whole web, and no human ever decides to target your business specifically. Weak or shared admin passwords come second, especially where one login is passed around a team and nothing asks for a second factor.
Do I need an SSL certificate if my site does not sell anything?
Yes. Browsers label sites without HTTPS as not secure, and visitors see that warning before they read anything you wrote. Any contact form is sending someone's name, email and phone number across the internet, and that deserves encryption in transit. Certificates are free with most hosting and renew themselves, so the only cost of having one is ten minutes of setup.
How much should a small business budget for website security?
For most sites, $50 to $400 a month covers it. That buys hosting with proper isolation, monitored updates, off site backups with a tested restore, and a firewall. Brochure sites sit at the bottom of the range, stores at the top. Set that against a post infection rebuild plus the revenue lost while the site is offline and the decision stops being difficult.
What should I do first if I think my site has been hacked?
Take the site offline or into maintenance mode, then change every password: hosting, CMS, database, registrar, connected email. Before you clean anything, copy the current files and server logs somewhere safe, because cleaning destroys the evidence you need. Restore from a backup taken before the first sign of trouble, then find and patch the actual entry point. Skip that last step and the same attack returns.
The takeaway
Security for a small business site is not a product you buy once. It is a short list of habits: patch quickly, control who has access, back up somewhere the attacker cannot reach, and know in advance who you call. Do those four things and you have closed off most of what actually happens to sites like yours. Skip them and no plugin will save you.