Website security checklist for small businesses
A complete website security checklist for small businesses: SSL setup, brute-force protection, plugin patching, daily backups, and WAF firewalls.
By Shariq Riaz6 min readMore hosting and security guides
To secure a small business website, enforce multi-factor authentication on all administrative accounts, install an active web application firewall, apply software updates weekly, and store encrypted daily backups in an offsite cloud location. These baseline defenses stop most automated attacks and protect your customer data from unauthorized access.
Many small business owners assume their website is too small to attract cybercriminals. In reality, automated attack bots do not care about your company's revenue. They scan the web continuously, probing millions of web servers for unpatched plugins, exposed database configurations, and weak login credentials.
Use this checklist to audit your website's security posture and eliminate common vulnerabilities.
Phase 1: Authentication and access control
Compromised administrative credentials are the easiest route into your website. Lock down access before configuring server software.
| Security control | Status check | Why it matters |
|---|---|---|
| Strong unique passwords | Enforce 16+ character random passwords | Stops automated credential stuffing attacks |
| Multi-factor authentication (MFA) | Require authenticator app codes on admin accounts | Blocks logins even if a password leaks in a public breach |
| Remove "admin" username | Replace default usernames with distinct handles | Eliminates 50% of the guesswork in brute-force attacks |
| Limit login attempts | Block IP addresses after 5 failed login attempts | Prevents dictionary attacks from cycling thousands of passwords |
| Audit user roles | Restrict administrator privileges to core managers | Prevents contractors from accidentally altering critical settings |
If an employee or contractor experiences a personal credential leak, follow our emergency protocol on how to secure accounts after a data breach.
Phase 2: Software updates and patch hygiene
Outdated software accounts for the overwhelming majority of successful website compromises. Hackers monitor public security databases (CVEs) and release automated exploit scripts within hours of a vulnerability disclosure.
Maintain current CMS core software
Whether you use WordPress, Drupal, or an e-commerce platform, apply minor security patches immediately. Major version releases should be tested on a private staging copy before deploying to production.
Delete inactive plugins and themes
Deactivated plugins still contain executable PHP files on your server. If an attacker knows the direct path to an outdated, deactivated plugin file, they can execute remote code. Delete all unused themes and plugins completely from your server disk.
Keep your PHP runtime updated
Web hosts frequently run outdated PHP versions (such as PHP 7.4 or 8.0) that have reached their official end-of-life and no longer receive security patches. Confirm with your hosting provider that your environment runs an actively supported PHP version (PHP 8.2 or newer).
Routine patching is a core deliverable of any professional care retainer. Review our breakdown of website maintenance cost to evaluate what preventative maintenance costs versus emergency cleanup fees.
Phase 3: Encryption and network security
Encrypting data in transit protects your customer inquiries, user passwords, and credit card payments from network interception.
Enforce SSL/TLS certificates across all URLs
An SSL/TLS certificate encrypts traffic between the visitor's browser and your web server.
- Enforce automatic HTTP-to-HTTPS redirects across all pages.
- Ensure your certificate is issued by a recognized certificate authority and renews automatically before expiration.
- For a detailed explanation of encryption handshakes and certificates, read our guide on ssl certificates explained.
Implement modern HTTP security headers
Security headers are server directives that tell modern web browsers how to handle your site's content safely:
| Security header | Directive purpose | Protection provided |
|---|---|---|
| Strict-Transport-Security (HSTS) | Enforces HTTPS communication | Prevents man-in-the-middle downgrade attacks |
| X-Frame-Options | Blocks framing on external sites | Prevents clickjacking attempts inside hidden iframes |
| Content-Security-Policy (CSP) | Restricts authorized script origins | Blocks cross-site scripting (XSS) payloads |
Phase 4: Server configuration and file integrity
Hardening your server environment stops attackers who attempt to inject malicious code into your website's file structure.
| Hardening measure | Configuration standard | Protection provided |
|---|---|---|
| File permissions | 644 for files, 755 for directories | Prevents unauthorized scripts from modifying core code |
| Disable dashboard file editing | Set DISALLOW_FILE_EDIT to true | Prevents compromised admin accounts from editing PHP code |
| Disable XML-RPC | Block xmlrpc.php access | Stops high-volume brute-force attacks and DDoS amplification |
| Protect configuration files | Restrict access to wp-config.php / .env | Prevents public web scrapers from reading database passwords |
| Web Application Firewall (WAF) | Deploy Cloudflare or Sucuri WAF | Filters malicious bot traffic before it reaches your host |
A properly configured Web Application Firewall analyzes incoming HTTP requests in real time, dropping requests containing known SQL injection strings or cross-site scripting signatures before they ever touch your server.
Phase 5: Backup architecture and disaster recovery
No security protocol is completely impenetrable. A comprehensive security strategy assumes that incidents can happen and maintains a dependable recovery plan.
Follow the 3-2-1 backup standard
- Keep at least 3 copies of your data (your live website and two backup archives).
- Store backups on 2 different storage types (local server disk and cloud object storage).
- Keep at least 1 copy completely offsite (such as Amazon S3 or Google Cloud Storage, completely isolated from your web host).
Test restoration quarterly
A backup is worthless if the archive file is corrupted or missing database tables. Schedule a calendar reminder every quarter to restore a random backup snapshot to a private staging environment. Verify that user logins, form submissions, and database records function properly.
For technical instructions on setting up automated backups, read our guide on website backups.
Phase 6: Continuous monitoring and alerting
Security is not a one-time project that you finish and forget. Continuous monitoring ensures you detect unauthorized activity before it damages your business reputation.
Automated uptime tracking
If an attacker takes your site down or a server error crashes your web service, you need to know within sixty seconds. Automated ping monitors test your server around the clock and alert your team via SMS or email when issues arise.
Google Search Console security alerts
Connect your site to Google Search Console. If Google's web crawlers detect malicious redirects, phishing pages, or injected spam on your domain, Search Console delivers an immediate security notification to your administrative email.
File integrity scanning
Deploy security software that takes daily cryptographic hashes of your core files. If an unauthorized script modifies your index.php file or injects links into your footer template, file integrity monitoring flags the change instantly.
What to do if your site is compromised
If you suspect your website has been hacked:
- Take the site into maintenance mode. Display a temporary maintenance page to prevent visitors from seeing malicious redirects or receiving malware warnings.
- Change all server credentials. Immediately reset your hosting cPanel passwords, SFTP logins, database passwords, and administrative CMS user accounts.
- Restore from a clean backup. If you know the date of the compromise, restoring an offsite backup snapshot from forty-eight hours before the breach is often faster than hunting for obfuscated backdoor scripts.
- Request Google review. Once your files are clean, submit a reconsideration request inside Google Search Console to remove browser security warnings.
Managed website security from Techcelerant
Managing firewalls, patching plugins, and monitoring server health requires consistent technical attention that busy business owners rarely have time to spare.
Through our website hosting and maintenance services, Techcelerant's care plans include daily backups and software updates from $49 a month, with malware scanning and a firewall on Business care ($129 a month). Compare the tiers on our pricing page or contact us about your site.
Frequently asked questions
What are the most common security vulnerabilities on small business websites?
The most common vulnerabilities are outdated software plugins, weak administrative passwords without multi-factor authentication, unencrypted HTTP connections, and unprotected login portals vulnerable to brute-force credential attacks.
Do small business websites really get targeted by hackers?
Yes. Hackers rarely target small business websites by name. Instead, they deploy automated bots that crawl millions of IP addresses scanning for known security flaws in popular software like WordPress or Magento to inject SEO spam, steal customer credit cards, or spread malware.
How often should you run a website security audit?
Run an automated security scan weekly to check for malware and plugin vulnerabilities, and perform a manual administrative audit quarterly to remove inactive user accounts, review file permissions, and test backup restoration.
What should you do if your website gets hacked?
Immediately take the site into maintenance mode, change all database and administrative passwords, inspect access logs to identify the entry point, and restore the site from a verified clean offsite backup taken before the compromise occurred.