Security · 5 min · Updated
Five website security basics every business should have
A practical website security checklist for small and medium businesses: updates, admin access, backups, firewalls and monitoring.
Most website compromises are not sophisticated. They use old, known weaknesses that were never patched, or passwords that were reused elsewhere. These five basics close most of those doors.
1. Keep everything updated
Update the CMS, themes, plugins and server software promptly. Most attacks on WordPress sites, for example, target plugins with published vulnerabilities. Remove plugins you no longer use rather than leaving them disabled.
2. Protect admin access
- Give every person their own account with only the permissions they need.
- Use strong, unique passwords stored in a password manager.
- Turn on two-factor authentication for every admin account.
- Remove accounts as soon as someone leaves or a contractor finishes.
3. Back up, and test the restore
Take automatic daily backups stored off the server, keep several days of history, and test restoring one at least every quarter. A backup you have never restored is a hope, not a plan.
4. Add a firewall and HTTPS everywhere
A web application firewall filters common attacks before they reach your site. Serve every page over HTTPS, redirect HTTP, and keep the SSL certificate renewing automatically.
5. Monitor and know who to call
Monitor uptime, certificate and domain expiry, and file changes, so you hear about problems before customers do. Write down who is responsible for the site, the hosting and the domain, and how to reach them out of hours.
Personal data
If your forms collect personal data, collect only what you need, protect it in transit and at rest, and make sure your privacy notice explains how it is used. Data protection laws such as UK and EU GDPR apply to most businesses.
No website can be guaranteed completely secure, but these basics reduce the risk dramatically. Penta Services care plans include updates, backups, monitoring and security checks.
Want this done for your business?
Talk to a project lead. You will get a clear plan and a fixed quote within one business day.