Website Security for Small Businesses: What Actually Protects You

A client forwarded me an email a few months back: "URGENT — Your SSL Certificate Has Expired, Renew Now for $89.99 to Avoid Website Shutdown." He wanted to know if he should pay it before his site went dark. He was one click away from typing his card number into a page that had nothing to do with his actual hosting account. That email was a scam — a pattern that lands in small business inboxes constantly, dressed up to look official, timed to make you panic before you check anything. And honestly, that's most of what passes for "website security" advice aimed at small business owners: noise dressed as urgency. The stuff that actually keeps a site from getting hacked is a lot more boring, and it never emails you in all caps.

What does "website security" actually mean for a small business?

It means six unglamorous habits done consistently: HTTPS encryption, keeping your software and plugins updated, backing your site up somewhere off the server itself, using strong unique passwords with two-factor authentication, filtering spam and bots on public forms, and knowing exactly who has admin access. None of it requires a dashboard full of red and green lights or a monthly "security report" PDF. Most of it costs nothing but a bit of consistency.

Where it gets marketed to you differently is the point. Hosting companies and plugin vendors have every incentive to make security sound complicated and scary, because "complicated and scary" is what gets you to click "upgrade." The actual list of things that matter is short, and I'd rather hand it to you directly than let you find out about it from an upsell popup.

Are small business websites actually getting hacked, or is this overblown?

It's real. One in four small businesses reported a cyberattack or data breach in the past year, and most of them already had security training, tools, and audits in place before it happened, according to a 2026 survey of 3,000 business and IT leaders across six countries. But almost none of that is a person specifically targeting your business — it's automated scanning, and patching the known holes is what actually stops it.

The tools-didn't-help part is the part worth sitting with. Proton's report found the gap wasn't a lack of spending — it was human error and inconsistent use: tools switched on but not updated, backups scheduled but never tested, 2FA available but not required. Separately, Verizon's 2026 Data Breach Investigations Report noted something that had never happened in its 19-year history: vulnerability exploitation — attackers using a known, unpatched software hole — overtook stolen passwords as the single most common way attackers get in. Translation: the boring habit of actually applying updates matters more this year than it has in nearly two decades of the same report.

Nobody hacks a flower shop's website because they hate flower shops. They hack it because the plugin was three versions out of date and the scanner found it in under a second.

Real risk vs. marketing fear: how to tell them apart

Most of what shows up in your inbox or your hosting dashboard labeled "security" falls into one of two buckets — a real thing worth ten minutes, or noise designed to sell you something. Here's how I sort it for clients:

The 6 basics that cover almost everything

This is the actual list. I check every one of these on a site before I'll call it "secure," and it's the same list whether the site is mine, a client's, or one I'm doing a free audit on.

1. HTTPS / SSL turned on. Free through Let's Encrypt on nearly every host today. If yours charges extra for it, that's worth questioning.
2. Software and plugins kept updated. The single highest-impact habit on this whole list — this is what the DBIR's "vulnerability exploitation" stat is really about.
3. Backups stored off the server itself, automatically, on a schedule — and tested by actually restoring one occasionally, not just confirmed by a checkbox that says "backup complete."
4. Unique passwords with two-factor authentication on every login that touches the site: hosting panel, CMS/admin, domain registrar, and the email account tied to all of it.
5. Spam and bot filtering on every public form. I run Cloudflare Turnstile on every site I build — it's free, invisible to real visitors, and it's the difference between a contact form and an open door for bots.
6. A known, short list of who has admin access — and removing it the day someone (an employee, a past freelancer) no longer needs it.

If your site runs on WordPress, here's exactly where the real risk lives

91% of new vulnerabilities discovered across the WordPress ecosystem in 2026 were found in plugins. WordPress core itself had exactly 6 issues all year, and every one was rated low-priority, according to Patchstack's State of WordPress Security report. The platform isn't the danger — a stack of 30–40 plugins nobody's opened since the day they were installed is.

I see this pattern constantly: a site running a plugin that was added for one feature three or four years ago, whose developer stopped maintaining it a year after that, still active and still able to log in and write to the database. Nobody remembers it's there until it's the reason the site got hacked. If you run WordPress, the highest-value ten minutes you can spend this week is opening your plugins list and asking, for each one: do I actually still use this, and when did it last get an update?

Neither platform is immune, and this isn't a pitch to abandon WordPress — plenty of well-maintained WordPress sites never have a problem. It's a pitch to know which platform you're on and patch accordingly. I go deeper on the actual decision between the two in custom-coded vs. WordPress, but on security specifically: coded sites remove the plugin risk entirely, WordPress sites need someone actually watching the plugin list.

What's the deal with the padlock, or the "Not Secure" warning?

It just means your site doesn't have an SSL certificate active, so data moving between a visitor's browser and your server isn't encrypted. It's not a hack, not malware, not a sign anything is broken — just a missing setting. Nearly every host issues a free certificate through Let's Encrypt now and renews it automatically; if a host is charging you extra for it, that's a line item worth challenging, in the same spirit as the checkout add-ons I cover in the hosting cart trap.

Is my small business actually a target, or am I too small to matter?

You're not the target — your unpatched software is. Attackers run automated scanners that check millions of sites for a handful of known weaknesses: an outdated plugin version, a default password, an exposed login page. It's closer to someone checking car door handles down an entire street than picking one house to break into. Being small doesn't protect you from that scan; being patched does.

1. Load your site and look for the padlock in the address bar. "Not Secure" is your first fix.
2. Log into your host or CMS and check for a pending update. Apply it.
3. Confirm backups are actually running — and stored somewhere other than the same server. Test-restore one if you never have.
4. Check who has admin access to your site, host, domain, and the email tied to all of it. Remove anyone who shouldn't still have it.
5. Submit your own contact form once. If nothing stops you, it's either already collecting bot spam or open to abuse.

Frequently asked questions