Website security and backups: the minimum every business owner should know

Small business owners often think: “who would bother hacking our site?” But most attacks are automated: bots scan thousands of sites for outdated plugins and weak passwords. You’re not the target — the weakness is. The good news: simple rules remove most of the risk.

1. Don’t postpone updates

System, theme and plugin updates frequently close known security holes. A site left un-updated for months is an open door. Remove plugins you don’t use altogether.

2. Protect logins

• A separate account for each user — no shared “admin” password.
• Long, unique passwords and a password manager.
• Two-factor authentication wherever possible.
• Remove access immediately when someone leaves.

3. Never store passwords and keys in the open

Database passwords, API keys and hosting credentials should never sit in the website folder as plain text files, inside code, or in chat threads. If such a file is accidentally uploaded to the server, the whole system can be exposed. If a key has leaked, deleting the file isn’t enough — rotate it in the provider’s dashboard immediately.

4. HTTPS and security headers

The whole site should load over HTTPS, with HTTP addresses redirecting automatically. Server-level security headers (Content-Security-Policy, X-Content-Type-Options and others) also instruct browsers to display your site more safely.

5. A backup only exists if it restores

The backup rule is simple: automatic, regular, and stored away from the site. Most importantly, restoring from backup must be tested periodically. An untested backup may fail exactly when you need it.

6. Monitoring: know before your customers do

Uptime monitoring checks every few minutes that the site loads and alerts you when it doesn’t. Track your SSL certificate’s expiry too — an expired certificate shows visitors an alarming warning.

Doing all of this consistently takes time. That’s why our website care plans are built around exactly this list.