Website security sounds like something for banks. It is not. Small business sites are broken into every day, and the reason is dull: automated programs scan every website on the internet for known weaknesses, and they walk in wherever the door is unlocked. Nobody chose you. You just left the door open.
The good news is that the fixes are habits, not expertise.
The padlock
Your site should load with a padlock in the browser and an address starting with https. That means the connection between the visitor and your site is encrypted, which matters most on enquiry forms. Browsers now warn people away from sites without it, and Google marks them down.
On modern hosting this is free and renews itself. If your site does not have it, that is a five minute job for whoever hosts it. If it had it and now shows a warning, the certificate has lapsed, and who to ring when your website breaks tells you who to call.
Passwords and two step sign in
The most common way in does not involve any clever hacking. Someone reused a password that leaked from another website years ago, and a program tried it.
Three habits fix this:
- A different password for every account that matters: website, domain, hosting, email. A password manager makes this painless.
- Two step sign in (sometimes called two factor or 2FA) switched on for all of them. It means a stolen password alone is not enough to get in.
- Remove old users. When a staff member, developer or agency moves on, remove their access the same week. Dormant accounts are the easiest way in.
Updates
If your site runs on WordPress or anything with plugins, those plugins need updating. Most of the WordPress break ins in the news came through an old plugin with a known hole that had been patched months earlier.
Whatever your site runs on, somebody needs to own the job of keeping it current, and you should know who. If nobody can answer that, the site is probably overdue for a look.
Backups
Ask one question: if the site vanished tonight, how would it come back, and how old would the copy be?
Most hosting companies and platforms keep backups, but check rather than assume, and know how to ask for a restore. If your site changes often, a copy from three months ago is not much use.
The emails that catch people out
The most common security problem we deal with is not on the website at all. It is an email saying your domain is about to expire, or your site has been suspended, with a link to pay. Some are real. Many are not.
The rule is simple: never pay through a link in an email. Go to the company's website yourself, log in, and check. A real renewal will be waiting there. A fake one will not.
What the website should never store
Keep card details, medical information and anything sensitive off your website unless you have a very good reason and professional help. An enquiry form should collect what you need to call someone back, and nothing more. The less you hold, the less there is to lose.
Watch for the quiet signs
A hacked small business site rarely looks hacked. More often it quietly starts serving spam links, or Google shows a warning next to your name, or your emails start landing in junk. Search for your business name once a month and look at what Google shows. Is your website losing you work includes that check among others.
A ten minute checklist
- Padlock showing on every page
- A different strong password on website, domain, hosting and email
- Two step sign in on all four
- Old users removed
- Updates happening, and you know who does them
- You know where the backups are and how to restore one
- Renewal emails checked by logging in, never by clicking
If you tick all seven, you are ahead of most businesses your size. If you cannot tick them, or you do not have the logins to find out, that is usually the real problem.
Every site we build sits in accounts in your own name, with the logins handed over and written down, so you always know who holds what. If you are not sure about yours, tell us about your business and we will look it over with you on a free 15 minute call.