Securing a small business website comes down to twelve controls: forced HTTPS, timely software updates, multi-factor authentication, least-privilege user accounts, a web application firewall, malware scanning, spam and bot protection on forms, tested backups, uptime and change monitoring, staff phishing awareness, an incident response plan, and consent-gated tracking. This checklist covers all twelve in order.
Attackers target small businesses precisely because they assume nobody is watching. Most website compromises are not sophisticated. Instead, they exploit an outdated plugin, a reused password, or a hosting account with no second factor. That is good news, because the defenses are equally simple: consistent basics beat expensive tools. Everything below applies to any platform and includes WordPress specifics, since that is what most small business sites run. For deeper context on how we approach this work, see our Cybersecurity services.
How do you secure the foundation?
Step 1: Force HTTPS everywhere. Every page should load over SSL, and your server should redirect HTTP requests automatically. Also confirm the certificate renews on its own. Expired certificates take sites down and train visitors to click through warnings. Finally, fix mixed-content warnings, where a secure page loads insecure resources.
Step 2: Update core, plugins, and themes on a schedule. Outdated plugins are the number one way attackers compromise WordPress sites. So set a weekly update window and remove plugins and themes you do not use, because deactivated code still invites attacks. Also check that every plugin you keep has an active developer behind it.
Step 3: Lock down logins with MFA. Enable multi-factor authentication on the website admin, the hosting account, the domain registrar, and the email account behind all three. A stolen password without a second factor is the cheapest attack there is. MFA closes off that easy path.
Step 4: Apply least privilege. Every user gets the minimum role they need. Contributors do not need administrator accounts. Remove former staff and old agencies today. Additionally, split shared logins into individual accounts so you can revoke access per person.
How do you block active attacks?
Step 5: Put a web application firewall in front of the site. A WAF filters malicious traffic, including SQL injection, credential stuffing, and known exploit patterns, before it reaches your site. Cloud WAFs also absorb basic denial-of-service attacks and cut server load.
Step 6: Run scheduled malware scanning. Compromises are often silent. For example, spam links, redirect code, and card skimmers can run for months with no visible symptoms. A scanner that checks core files, plugins, and the database on a schedule catches infections while they are small.
Step 7: Protect forms from spam and abuse. Contact and quote forms need bot protection, such as honeypots or a modern CAPTCHA, plus rate limiting. Beyond the nuisance, form abuse pollutes your lead pipeline, and attackers can use it to probe for injection flaws.
Step 8: Back up automatically, store off-site, and test restores. Schedule daily automated backups and keep them for at least 30 days. Store them somewhere other than the hosting account itself, because a compromised host can mean compromised backups. Most importantly, test a restore quarterly. A backup you have never restored is a hope, not a plan.
Want steps 1 through 8 done in one pass? Our Website Security Reinforcement Package hardens the site end to end: HTTPS and headers, update cleanup, MFA rollout, WAF, scanning, and verified off-site backups. You also get a report documenting every control.
How do you catch problems early?
Step 9: Monitor uptime and file changes. Uptime monitoring tells you the moment the site goes down. Meanwhile, file integrity monitoring tells you when code changes outside a planned update. That is how you catch quiet compromises in hours instead of months.
Step 10: Train the humans. Most breaches start with a phishing email, not a technical exploit. So run a short quarterly refresher for anyone with website, hosting, or email access. Cover credential phishing and invoice fraud. That habit prevents more incidents than any plugin.
Step 11: Write a one-page incident response plan. Before anything happens, decide four things. Who takes the site offline? Next, decide who restores from backup. Then assign someone to contact the host.And who informs customers if data was involved? In an actual incident, the plan is the difference between a bad afternoon and a bad month.
Step 12: Make your tracking consent-gated. Security and privacy converge here, because third-party scripts are both an attack surface and a legal exposure. Audit what runs on your site, remove what you do not use, and gate the rest behind consent. The privacy side has its own walkthrough in our CIPA Compliance Checklist.
Website cybersecurity checklist: DIY vs managed security
The honest failure mode for small businesses is not choosing bad tools. Rather, it is that nobody owns the routine. Here is the realistic comparison:
| Control | DIY reality | Under a maintenance plan |
|---|---|---|
| Updates | Applied in bursts, skipped in busy months | Weekly, on schedule, with rollback |
| Backups | Configured once, restore never tested | Automated, off-site, restore-tested |
| Malware scanning | Free scanner installed, alerts unread | Scheduled scans, alerts triaged by a human |
| Monitoring | None, or an uptime ping nobody checks | Uptime plus file-change alerts, acted on |
| Response to an incident | Improvised over a panicked weekend | Documented plan, executed by the team that knows the site |
That table is why our WordPress Maintenance and Website Management plans exist. The checklist above only helps a business if it runs every week, including the weeks everyone is busy.
What should you do first?
If you do nothing else this week, do three things. First, turn on MFA everywhere. Second, run all pending updates. Third, confirm you keep a backup outside your hosting account. Those three close the doors most attacks actually walk through. Then work through the rest, and see the deeper hardening detail in our Website Security Hardening guide.
Not sure which of the twelve you already have covered? Request a free website security assessment. We check all twelve controls and send a plain-English scorecard of where your site stands. Start with our Cybersecurity services.
Website cybersecurity checklist FAQs
The basics are inexpensive. SSL is typically free through your host, MFA costs nothing, and quality backup and firewall tools run modest monthly amounts. The larger investment is consistency, which is why many small businesses fold security into a monthly maintenance plan instead of buying tools that nobody manages.
Weekly at minimum, and apply critical security releases as soon as they ship. Outdated plugins are the most common cause of WordPress compromises. So a fixed weekly update window with a pre-update backup is the practical standard.
Common indicators include unexpected redirects, new admin users you did not create, spam pages appearing in Google results for your domain, browser security warnings, a sudden traffic drop, or your host flagging malware. Silent compromises are common too, which is why scheduled scanning matters even when everything looks normal.
Constantly, but rarely personally. Most attacks come from automated bots scanning the entire internet for known vulnerabilities, so the same tools probe a five-page local business site and a national brand alike. However, automation is also why consistent basics stop the overwhelming majority of attempts.
Yes, for encryption. Free certificates provide the same encryption strength as paid ones. What matters is forcing HTTPS sitewide, auto-renewing the certificate, and keeping every page free of mixed insecure content.
Take the site offline or into maintenance mode, then change all passwords for the site, hosting, and email, with MFA enabled. Next, restore from a clean backup that predates the compromise. Finally, identify and patch the entry point before going live. If customer data may be involved, consult counsel about notification obligations.
This checklist is general guidance, not a substitute for a professional security assessment of your specific website and hosting environment. If you believe your site is actively compromised or customer data may be exposed, act immediately and consult qualified security and legal professionals.
