Website security for small businesses: the essential basics

Many owners think: who would attack my little site? The answer is automated programs. They search around the clock for known vulnerabilities, no matter how big a business is. The good news: with a few basics you are well protected against most of these attacks.

Install updates promptly

Outdated systems, themes and plugins with known vulnerabilities are one of the most common causes of hacked websites. With WordPress, most newly reported vulnerabilities affect plugins rather than WordPress itself (source: patchstack.com, annual report "State of WordPress Security"). For you that means: install updates promptly and delete plugins you do not need instead of just deactivating them. Every installed extension is a possible weak point.

Strong passwords and two-factor authentication

• A separate, long password for every login. A password manager helps.
• Turn on two-factor authentication wherever possible: with your host, your domain provider, in the website admin and in your Google account.
• No shared logins for several people. Everyone gets their own account that can be locked later.

The German Federal Office for Information Security (BSI) offers clear recommendations on this (source: bsi.bund.de, topics "Sichere Passwörter erstellen" and "Zwei-Faktor-Authentisierung").

Backups that can actually be restored

A backup is only as good as the restore. Pay attention to three things:

• Backups run automatically, at least daily or after every change.
• One copy is stored in a different place than the server itself.
• You have tested at least once whether a backup can really be restored.

Securing forms

Contact forms are a popular target for spam and abuse. Protection includes:

• A limit on how often one address can send in a short time.
• An invisible field that only bots fill in, instead of an annoying picture puzzle.
• Checking all input on the server, not just in the browser.

HTTPS and security headers

HTTPS is a must. On top of that come so-called security headers that the server sends along. They tell the browser, for example, that the page may not be embedded in other sites or may only load scripts from certain sources. You can check for free at securityheaders.com whether your site sets such headers.

Less is safer

Every feature, every plugin and every embedded third-party script increases the attack surface. A lean site with few, deliberately chosen components is faster and easier to keep secure.

If something does happen

• Stay calm, change all passwords, inform your host.
• Restore the last clean backup and close the gap, otherwise it quickly happens again.
• If personal data could be affected, such as enquiries from the contact form, check the obligation to notify the data protection authority. It generally applies within 72 hours (Art. 33 GDPR). This is not legal advice.