Cybersecurity
Keeping your business website secure: a practical checklist
Most small business websites are hacked through simple gaps: an out-of-date plugin, a reused password or a site nobody looks after. These checks close most of them.
By the CNS team · · 4 min read
Key takeaways
- Out-of-date plugins and themes are one of the most common ways websites are hacked.
- Protect admin logins with multi-factor authentication and remove old accounts.
- Keep off-site backups and test that you can restore them.
- Make sure someone is responsible for updates and monitoring every month.
Why small business websites get hacked
Attackers rarely target a small business website by hand. Automated tools scan the internet for sites running software with known weaknesses, then break in to send spam, host scam pages or spread malware. A hacked site can be blocked by browsers and search engines, and it damages trust with clients.
The checklist
- Keep everything updated. Apply updates to the website software, theme and plugins promptly.
- Remove what you don’t use. Delete old plugins, themes and test copies of the site.
- Protect logins. Use multi-factor authentication and unique passwords for every admin account.
- Limit admin accounts. Give people only the access they need, and remove accounts when staff leave.
- Back up off-site. Keep regular backups away from the web server, and test a restore.
- Put a firewall in front. A web application firewall blocks common attacks before they reach the site.
- Use HTTPS everywhere. Keep the certificate valid and redirect all traffic to the secure address.
- Monitor it. Get an alert if the site goes down or its files change unexpectedly.
Forms and visitor data
Contact and newsletter forms collect personal data, so the Data Protection Act applies. Say what you collect and why in your privacy policy, collect only what you need, and protect forms from spam bots. If you add tracking or advertising cookies, you’ll need consent and an updated policy first.
Who looks after it?
Many websites are built, launched and then forgotten. Agree who is responsible for updates, backups and monitoring, whether that’s someone on your team or your web provider, and check every month that it’s being done.
How CNS can help
We build professional WordPress websites and look after them with secure managed hosting, a security network in front of the site, regular updates, off-site backups and monitoring.
Sources
More insights
Questions about your own setup?
Talk to a Cayman IT expert. No obligation, no jargon.