Website security: a checklist for small and mid-sized businesses
Small businesses often think they're too unimportant to be attacked. But most attacks on websites are automated and simply look for outdated software and weak passwords, regardless of who owns the site. A hacked website spreads malware, sends spam or leaks customer data. This checklist shows the measures that reduce the risk most.
The ten most important measures
These points cover the most common attack paths:
- 1. Keep CMS, plugins, themes and server software up to date, testing updates on a staging copy first.
- 2. Remove unused plugins and old admin accounts.
- 3. Two-factor login for all admin accounts, hosting and domain management.
- 4. Strong, unique passwords from a password manager.
- 5. Daily backups at a second location and regularly tested restores.
- 6. HTTPS with an automatically renewed certificate and HTTP redirect.
- 7. Security headers such as HSTS and Content-Security-Policy.
- 8. Protect forms against spam and automated attacks, restrict uploads.
- 9. Protect login pages against automated password guessing.
- 10. Monitoring: uptime, certificate expiry, unexpected file changes.
The obligation behind it
Article 32 GDPR requires appropriate technical and organisational measures for the security of personal data, measured against the state of the art. A website with a contact form, customer account or shop is covered. If a personal data breach occurs, Article 33 GDPR generally requires notifying the supervisory authority within 72 hours.
When it has happened
In an incident, the order matters:
- Take the website offline or put it into maintenance mode.
- Change all passwords: CMS, hosting, database, FTP, email.
- Check whether personal data is affected and keep the 72-hour notification deadline in mind.
- Restore from a clean backup from before the incident and close the gap.
- Check in Google Search Console whether the site is flagged as dangerous and request a review.
Maintenance instead of hope
Security isn't a one-off project. With a maintenance plan, updates, backups and monitoring run regularly, and there's a fixed contact when something goes wrong. Our maintenance plans start at €49 a month for monitoring and up to one hour of fixes.
Frequently asked questions
- Is a static website more secure than WordPress?
- Usually yes, because there's no login page and no plugins on the public server. Dependencies, hosting and form services still need to be kept current.
- How do I know my website was hacked?
- Typical signs: unknown pages or links in Google, redirects to foreign sites, browser warnings, spam from your form or domain, unknown admin accounts.
- What does a security check cost?
- A basic check of versions, access, backups and headers is quick. We give you the effort after a look at your website.
Sources
Send us your website address. We check versions, access, backups and security headers and tell you what to do.
Have my security checked