Website Security for People Who Aren’t Techies

Website security for a small business comes down to five unglamorous habits: keep your site’s software up to date, use strong passwords with two-factor turned on, limit who has the keys, make sure your site loads over a secure connection, and keep a backup you have tested. None of it requires understanding how any of it works.

It is also worth saying plainly: nothing makes a website unhackable, and anyone promising otherwise is selling something. The two realistic goals are being a harder target than the site next door, and being able to get back on your feet quickly when something does go wrong. Both are achievable in an afternoon.

Why anyone would bother attacking a plumbing website

It is a fair question. You are not a bank. You have nothing anybody wants. Why would anyone bother?

They are not coming after you. That is the most useful thing to understand about this whole subject. Most of what happens to small websites is automated — programs wandering the internet at enormous scale, knocking on every door they find, checking whether a known weak spot has been left open. They do not know your name or what you sell. Your site is a door number, not a target.

And the prize is rarely your data. What a hijacked site is worth is its reachability and its good name — somewhere to send spam from, host a fake login page, or hide links to junk sites where only search engines see them. A site with nothing to steal is still worth hijacking.

The padlock: what HTTPS and SSL actually do

When someone visits your site, information travels between their device and the machine your site lives on. HTTPS is that journey happening in a sealed envelope rather than on a postcard. The certificate — the thing usually called SSL — is what proves your site is entitled to seal the envelope.

What it protects: anything a visitor types on your site, especially contact details and card numbers, on the way to you. What it does not do: make your site safe. The padlock is about the journey, not the building — plenty of scam sites have one. It is necessary, not sufficient.

Browsers also put a visible “Not secure” warning on sites without it, which is not a great look next to your phone number.

How to check yours is working

1. 1Type your address with no www and no https — just yourbusiness.com — and press enter. It should land on a page starting with https, with a padlock. Check a few inside pages too, not only the home page.
2. 2If you can still reach an unlocked version of your site, the redirect is not set up properly. That is worth someone fixing.
3. 3If a page shows the padlock with a warning on it, that is usually mixed content: the page arrives sealed, but one item on it — often an old image or an embedded map — still arrives the insecure way. Browsers keep complaining until someone fixes it.
4. 4Find out whether the certificate renews automatically. Most do. The ones that do not tend to lapse on a holiday weekend, and a lapsed certificate replaces your site with a full-page warning most visitors will not click past.

Updates are the boring thing that matters most

Your website is not one solid object. It sits on a platform, and that platform usually has add-ons bolted on — a contact form, a booking calendar, a photo gallery, a reviews widget. Each was written by someone, and every so often one turns out to have a flaw.

Here is the mechanism that explains most of website security. When a flaw is found, the makers release a fix — and releasing the fix also publishes the existence and location of the flaw to everybody, including the people writing the automated scanners. So your risk is not about how clever anyone is. It is about how long you sit on a published fix without applying it.

Which brings up the tension nobody mentions: updates occasionally break things. An add-on updates, stops agreeing with another, and your contact form quietly stops sending. That is why people avoid updating — and why the answer is not “never update” but “update on a schedule, with a backup taken first.”

One free improvement while you are in there: delete anything you are not using. Every add-on is a door you are responsible for whether or not you ever walk through it. A gallery plugin from three redesigns ago does nothing for you and still needs watching.

Passwords, two-factor, and the account everyone forgets

The most common way a small site gets taken over is not a technical break-in. It is somebody logging in as you — because the password was easy to guess, or because it was one you also used somewhere else that had a leak of its own.

So: a different password everywhere, long rather than clever, kept in a password manager rather than your head. A few unrelated words are harder to guess and easier to type than a mess of symbols you will end up writing on a note.

Then turn on two-factor authentication, which is the code from your phone after your password. It is the highest-value ten minutes on this list, because it makes a stolen password nearly worthless on its own. Do it in three places, in this order:

• The email account your website accounts are registered to. This is the master key: anyone in your email can request a password reset for everything else and simply collect it.
• Your domain account — the company you buy yourbusiness.com from, which may not be the company hosting your site. Whoever controls the domain controls where your name points. This is the account owners forget exists, sometimes for years.
• The website itself, and your hosting account.

While you are in the domain account, check its contact email is one you still read and that the domain is not about to expire. An expired domain takes your website and your email down together.

Who has the keys

Every person with full admin access is another laptop, another password habit and another email account your site now depends on. This is not about trusting people. It is arithmetic.

Look at who can log in. Most sites have collected more names than the owner remembers: whoever built it, an agency used for one campaign, an employee who left last spring. Remove the ones who no longer need to be there, and give everyone else the smallest access that lets them do their job — whoever writes your blog posts does not need the power to delete the site.

Two habits worth keeping. Do not share one login between several people, or nobody can be removed without disrupting everybody. And when someone leaves, take their access away the same week.

What to do first if you think you have been hacked

The usual signs: a browser warning in front of your own site, a note in search results saying it may be harmful, customers saying they got sent somewhere strange, pages you did not write, or a flood of contact-form spam.

If any of that is happening, work through this in order rather than jumping to the middle.

1. 1Do not start deleting things. Write down what you saw and when you first saw it — that date tells you which backup is clean.
2. 2Change your passwords from a different device — email first, then domain, then hosting, then the website. Turn on two-factor in each while you are there.
3. 3Tell your host. They can see things you cannot from the outside, and may well have handled the same thing for someone else that morning.
4. 4If your site is showing visitors something harmful, put up a simple holding page. A quiet page with your phone number beats a site sending customers somewhere bad.
5. 5Restore from a backup taken before the date in step one. That is quicker and more certain than picking an infection out by hand, where the problem is never being sure you got all of it.
6. 6Then close the door: update everything, remove add-ons you do not use, and review who has access. A restore without this step means doing it all again in a few weeks.
7. 7If search engines or browsers flagged you, ask them to look again once you are clean. That warning does not clear on its own.

Read that list once now, while nothing is wrong. The part people get wrong under pressure is step one: the instinct is to delete suspicious things immediately, which destroys the evidence of when it began.

Notice how many of those steps depend on having a good backup. Everything else here reduces the chance of a bad day. Backups decide how long the bad day lasts.