Website security basics for small businesses

Small business websites get attacked not because anyone is targeting you personally, but because automated programs scan the whole internet looking for out-of-date software and weak passwords. The good news is that a handful of habits block almost all of it.

The checklist

• HTTPS everywhere: your address should start with https and show no warnings. It protects anything visitors type, and browsers label sites without it "Not secure".
• Keep software updated: if your site runs on a content management system, its core, theme and every plugin need regular updates. Most hacked small sites were running something out of date.
• Remove what you don't use: old plugins, test pages and former staff accounts are all ways in.
• Strong, unique passwords: use a password manager, and never reuse your website password anywhere else.
• Two-step login: turn it on for your website, your domain account, your hosting and your email. These four accounts control your whole online presence.
• Backups you've tested: keep copies away from the website itself, and check that a backup can actually be restored.
• Security headers: simple instructions sent with each page that stop browsers doing risky things, such as letting your site be framed by another one.

Why static websites are safer

A traditional website runs code and a database every time someone visits, and that code needs constant patching. A static website is a set of finished pages with no login page, no database and no plugins on the live site, so the most common attacks have nothing to aim at. That's the main reason we build this way: there's very little to keep patching, and nothing for a bot to break into.

Your domain and email matter as much

If someone gets into the account where your domain is registered, they can redirect your website and your email. Protect it with two-step login and keep the contact email up to date. For email, see our guide to setting up business email and its anti-spoofing records.

What if something goes wrong?

If you see strange pages, warnings in Google, or emails you didn't send, change your passwords from a clean device, turn on two-step login, and get the site checked. Our hosting and care includes HTTPS, security headers, version history and monitoring as standard.

Got more questions? See our Speed, safety & security FAQs or the £350 website package.

Last reviewed 2026-10-30 by the IceWork team.