Website security basics: how to protect a small business website

Why would anyone hack a small business website?

Most small business websites are not hacked by someone who chose them; they are found by automated bots that scan huge numbers of sites for known weaknesses, such as an outdated plugin or a reused password. Being small does not make you invisible, it often makes you easier.

Once inside, attackers use a website to:

• Send spam or host phishing pages that imitate banks and delivery companies.
• Insert hidden links and spam pages to manipulate search results.
• Redirect visitors to scams or infect them with malware.
• Steal data submitted through forms, such as names, phone numbers and messages.
• Use the server’s resources for other attacks.

The damage to the business is real: browsers and Google can warn visitors away from a compromised site, hosts may suspend it, customers lose trust, and if personal data is exposed, privacy laws come into play.

What are the essential website security measures?

The essential website security measures are HTTPS, regular updates, strong logins with two-factor authentication, off-site backups, minimal access and basic protection for forms. Together they cover the openings automated attacks rely on.

HTTPS deserves a note: the padlock means the connection is encrypted, not that the website itself is safe. It is essential, but it is only the first item on the list.

How do you secure website logins and admin access?

Secure website logins by giving every person their own account with the lowest level of access they need, protected by a unique password and two-factor authentication. Shared logins and forgotten accounts are among the easiest ways in.

1. Use a password manager so every account has a long, unique password nobody needs to remember.
2. Turn on two-factor authentication for the website admin, hosting, domain registrar, DNS and email accounts.
3. Give each person their own login; never share one admin account across the team.
4. Use roles: someone who writes blog posts does not need permission to install plugins.
5. Remove old accounts for former staff, freelancers and agencies as soon as the work ends.
6. Limit login attempts so bots cannot guess passwords endlessly.
7. Never send passwords by chat or email; share access through invitations or the password manager.

The domain registrar account deserves special care, because whoever controls it controls your website and email. Our guide to domains and hosting explains why it should sit in your business’s own account.

How should you back up a website?

Back up your website automatically, keep copies away from your main hosting, and test that you can actually restore them. A backup you have never restored is a hope, not a plan.

A widely used approach is the 3-2-1 rule: keep three copies of your data, on two different types of storage, with one copy off-site. For a website, that usually means the live site, a backup held by your host and a separate backup stored with another provider.

• Back up files and the database, plus any form submissions or bookings stored on the site.
• Match frequency to change: daily for sites with bookings or regular updates, weekly for sites that rarely change.
• Keep several versions, because a hack may go unnoticed for days and the most recent backup could already be infected.
• Test a restore to a temporary location at least a couple of times a year.

Are WordPress plugins and website builders a security risk?

Plugins are not dangerous in themselves, but every plugin is extra code written by someone else, and outdated or abandoned plugins are a frequent route into WordPress sites. The fewer you use, and the better maintained they are, the smaller your risk.

• Remove plugins and themes you are not using, rather than only deactivating them.
• Avoid plugins that have not been updated for a long time.
• Never install “nulled” or pirated premium themes and plugins; they often carry hidden malware.
• Test updates on a staging copy first if the site is complex.

Website builders such as Wix and Squarespace handle server security for you, but your account, your passwords and any connected apps remain your responsibility. Custom-built websites with no admin plugins can have a much smaller attack surface. Our comparisons of WordPress vs a custom website and custom website vs Wix and Squarespace weigh these trade-offs, and website maintenance costs covers the cost of keeping a site updated.

What should you do if your website is hacked?

If your website is hacked, contain the damage first, then clean, then find and close the way in. Acting calmly and in order matters more than acting fast in every direction.

1. Take the site offline or put up a maintenance page if it is harming visitors.
2. Change every password: website admin, hosting, domain, DNS, email and any connected services.
3. Contact your host and developer, and keep a record of what you have found and when.
4. Restore a clean backup from before the hack, then apply all updates.
5. Find the entry point, such as an outdated plugin or a compromised account, and close it.
6. Check Google Search Console for security warnings, and request a review once the site is clean.
7. Assess whether personal data was exposed. Under Thailand’s PDPA, a personal data breach must be reported to the regulator without delay and, where feasible, within 72 hours, unless it is unlikely to risk people’s rights; affected people must also be told when the risk is high. The EU’s GDPR has a similar 72-hour rule.

If your website collects personal data through forms, chat or an AI agent, our guide to AI agents and the PDPA explains the wider obligations.

How much does website security cost for a small business?

Basic website security costs little: HTTPS certificates are often free, two-factor authentication and password managers are cheap or free, and backups and updates are part of any sensible maintenance plan. The expensive route is cleaning up after a hack, which costs time, money, search visibility and customer trust.

The most effective investment is often in how the website is built in the first place: fewer moving parts, fewer plugins, clear ownership of every account, and a plan for updates. At PJW Partners, we have built 50+ websites, and custom websites start from $1,500 USD. If you want a website that is simple to keep secure, or a second opinion on the one you have, tell us about your website.

Questions