Most business websites are not attacked because someone chose them personally. They are found by automated tools that scan the internet for weak passwords, outdated plugins and exposed admin pages. If your site has one of those gaps, it can be hit regardless of how small your business is.
The upside is that the basics block most of these attacks. You do not need a security team to put them in place. You need a checklist and someone responsible for following it.
1. Keep software updated
Outdated software is one of the most common ways websites get compromised. This includes the CMS itself, such as WordPress, plus themes, plugins and the server software underneath.
- Turn on automatic minor and security updates where your platform allows it.
- Check for plugin and theme updates at least weekly.
- Test major updates on a staging copy of the site before applying them to the live site.
- Delete plugins and themes you no longer use, rather than just deactivating them.
- Avoid "nulled" or pirated premium plugins; they often contain hidden malware.
Every plugin you install is code someone else wrote that runs on your site. Keep the list short and choose plugins with recent updates and active support.
2. Lock down logins
Admin logins are the front door of your site. Automated tools try common usernames and passwords on thousands of sites every day.
- Give every person their own account; never share one admin login.
- Use long, unique passwords stored in a password manager.
- Turn on two-factor authentication for all admin and editor accounts.
- Give each person the lowest role they need; most content editors do not need admin rights.
- Limit login attempts and consider restricting the admin area by IP or country.
- Remove accounts immediately when staff or freelancers leave.
Apply the same care to your hosting control panel, domain registrar and email accounts. If someone gets into your registrar, they can redirect your entire domain.
Every shared password is a door you cannot lock behind someone who leaves.
3. Use HTTPS everywhere
HTTPS encrypts data between your visitors and your site, protecting form submissions, logins and payments. Browsers mark sites without it as "Not secure", which puts off visitors before they read anything.
Most hosts and services such as Cloudflare offer free SSL certificates. Make sure the certificate renews automatically, that all pages redirect from HTTP to HTTPS, and that images and scripts load over HTTPS too. Set a reminder to check the certificate status every few months, as failed renewals are a common cause of sudden warnings.
4. Back up properly, and test restoring
Backups are your recovery plan for hacks, failed updates and accidental deletions. A backup you have never tested is a hope, not a plan.
- Back up both files and the database.
- Schedule backups daily for sites that change often, such as online stores.
- Store copies off the server, in a separate cloud storage account.
- Keep several versions, so you can go back to before a problem started.
- Restore a backup to a test location every few months to confirm it works.
For example, if your store is hacked and the malware went unnoticed for two weeks, a backup that only keeps the last three days will restore the infected site. Keep enough history to go back further.
5. Protect forms, add a firewall and monitor
Contact forms, comment sections and file uploads are common targets for spam and attacks. Add spam protection such as a CAPTCHA or honeypot field, validate inputs on the server, and restrict file uploads to the types you genuinely need. Never allow uploaded files to run as code on the server.
If you collect personal data such as names, phone numbers or ID documents, store only what you need, restrict who can see it, and delete it when it is no longer required. Customers in the UK and EU have legal rights over their data, and other markets are moving in the same direction.
A web application firewall filters malicious traffic before it reaches your site. Services such as Cloudflare offer this at the network level, and security plugins provide it within WordPress. Either is a sensible layer for most business sites.
Monitoring tells you when something has gone wrong, ideally before customers notice. Set up:
- Uptime monitoring that alerts you by email or WhatsApp when the site goes down
- Malware scanning on a regular schedule
- Alerts for new admin users or changed core files
- Google Search Console, which warns you if Google detects malware or hacked content
6. Know what to do if you are hacked
Write a short incident plan now, while things are calm. It should say who to call, where backups are stored and how to reach your host. A typical sequence looks like this: take the site offline or into maintenance mode, change all passwords, identify how the attacker got in, clean or restore from a clean backup, patch the weakness and then request a review in Search Console if Google flagged the site.
Restoring without finding the cause usually means being hacked again within days.
Making security routine
Security is not a one-time setup. Put a recurring monthly check on someone's calendar: updates applied, backups tested, user accounts reviewed, certificate valid and monitoring alerts working. An hour a month prevents most of the problems that cost businesses days of downtime.
If nobody on your team has time for this, Zartash Technologies offers ongoing care for business websites. Our Website Security service covers hardening, firewalls, malware scanning, backups and incident response, so your site stays protected without adding to your team's workload.