Website security can sound like something only big companies need to worry about. You’re a local café, a physio or a tradie. Who would bother hacking your site?
The honest answer is: probably nobody, personally. But a lot of website attacks aren’t personal at all. The good news is that a handful of sensible habits cover most of the risk, and none of them require you to become an IT expert.
Website security: why small business sites get targeted
Most attacks on small websites are automated. Bots scan the internet looking for sites with old software, weak passwords or open forms. They don’t care whose site it is. They’re just looking for an easy way in.
When they find one, the result might be spam links added to your pages, your contact form flooded with junk, or your site redirecting visitors somewhere dodgy. It’s frustrating, it can make customers wary, and cleaning it up takes time.
Good website security isn’t about making your site impossible to break into. It’s about making it not worth the effort.
Updates: the boring job that matters most
If you do one thing, keep your website software up to date. On a WordPress site, that means WordPress itself, your theme and your plugins.
Many updates fix security problems that have been discovered. Once a fix is released, the weakness it fixes is often widely known, so out-of-date sites become easier targets.
A few practical tips:
- Check for updates regularly rather than waiting until something goes wrong
- Remove plugins and themes you no longer use, as they still need updating
- Take a backup before running major updates
- Check the site afterwards to make sure everything still works
If that sounds like a job you’ll keep putting off, that’s normal. It’s exactly the kind of thing managed hosting is for.
Backups you can actually restore
A backup is your safety net. If an update breaks something or the site gets compromised, a good backup means you can get back to a working version.
It’s worth knowing the answers to these questions:
- Is your site being backed up, and how do you know?
- Where are the backups stored?
- Who would restore one if you needed it?
Lots of business owners assume their host has it covered, then find out the hard way that backups were never switched on, or that restoring one is up to them.
Ideally, backups are stored somewhere separate from the website itself, so a problem with the site doesn’t take the backups down with it.
SSL, passwords and two-factor authentication
SSL certificates
SSL is what puts the padlock in the browser’s address bar and the “https” at the start of your web address. It encrypts information travelling between your site and your visitors, which matters for contact forms and anything involving personal details.
Browsers warn people when a site isn’t secure, and that warning is enough to make many visitors leave. Every website we build includes an SSL certificate.
Strong passwords
Weak or reused passwords are one of the most common ways into a website. A few simple rules go a long way:
- Use a long, unique password for your website login, not one you use elsewhere
- Use a password manager so you don’t have to remember them all
- Give everyone their own login rather than sharing one account
- Remove logins for staff or contractors who no longer need them
Two-factor authentication
Two-factor authentication adds a second step when you log in, usually a code from an app on your phone. Even if someone gets hold of your password, they can’t get in without that code.
It takes a minute to set up and a few seconds each time you log in. Turn it on for your website, your email, your domain account and your social media accounts. The Australian Cyber Security Centre has more plain-English advice for small businesses.
Spam protection on your forms
Contact forms are a favourite target for bots. Without protection, you can end up with an inbox full of junk enquiries, and real ones can get lost in the mess.
Good spam protection works in the background, checking whether a form is being filled in by a real person. Most visitors never notice it. A form without it is like leaving your shop door propped open overnight.
If your website has been rebuilt or changed recently, it’s worth checking that the spam protection on your forms is still in place. It’s easy for it to go missing during a redesign.
Who’s watching your site?
This is the question most small businesses haven’t thought about. If your site went down or got hacked tonight, who would notice? Often it’s a customer, days later.
Signs worth watching for include pages you didn’t create, a sudden flood of form spam, security warnings in your browser, or customers mentioning that something looks odd. If you notice any of these, don’t ignore them. Get someone to take a look sooner rather than later.
Website security isn’t a one-off setup. It’s ongoing: updates, backups, renewals and keeping an eye out for anything odd. That’s why it helps to have someone looking after it.
Our managed Australian WordPress hosting is $49.95 + GST per month and includes backups and security updates, so those jobs come off your list. We also look after business email, domains and DNS, and give practical IT advice through Luke, our IT consultant. You can read more on our managed hosting and IT page.
If you’re planning a new site, every custom website we build is mobile-responsive and includes security and an SSL certificate from the start.
Not sure how secure your website is?
Book a free website health check and we’ll review your site’s performance, design and SEO, flag any issues and recommend practical improvements in plain English. It’s about 30 minutes, with no obligation. Get in touch or call 02 6610 9202.
