Security Basics for Small Business Websites

Small business websites rarely get attacked for being important. They get caught up in automated sweeps that look for easy openings: weak passwords, outdated software and forgotten accounts. The defenses that matter are mostly basic and boring, which is good news, because boring is within reach.

A secure connection

HTTPS is the secure form of the connection between a visitor and your site. It keeps the conversation private and lets the browser confirm it is talking to the right place. Check that your site opens with the padlock, that both the plain domain and the “www” form work, and that an insecure address redirects to the secure one.

Certificates expire, so find out whether yours renews automatically. A lapsed certificate puts a warning page between you and your visitors.

Logins you can defend

The most common way into a site is a password that someone else has already seen elsewhere. Use a different, long password for every account that can change your site, and keep them in a password manager rather than a notebook or a shared spreadsheet.

Turn on two-factor login wherever it is offered. Remove access for anyone who no longer needs it, including a designer you worked with last year. Every extra login is another door.

Updates and who handles them

Software that runs your site needs updates, and outdated parts are a common weakness. The question to settle is who applies them. On a hosted builder, the provider usually does. On a site you run yourself, it is you or someone you pay, and it needs to be a regular job, not an occasional one.

Backups you have tested

A backup is only useful if you can restore from it. Find out whether your site is backed up, how often, where the copies live and how you would bring one back. If the answer is “I assume so”, find out for sure.

Forms and outside scripts

Forms take input from strangers, so they deserve some protection against spam and misuse. Keep them short, and use the protections your tool offers. Be selective about outside scripts such as chat widgets and trackers, since each one runs code you do not control on your pages.

A worked example

This is an invented checklist, shown only as wording. Example Cafe reviews its site.

Connection: padlock present on both address forms. Certificate renews automatically. Logins: unique passwords stored in a manager. Two-factor on the site account. Former designer’s access removed. Updates: handled by the host. Backups: daily, restore tested once. Extras: chat widget removed, one analytics script kept.

Why boring wins

Security advice sounds dramatic, but the practice is dull on purpose. A calendar reminder to review accounts every few months, a password manager that fills the long passwords for you, a host that handles updates quietly: none of these makes a good story, and all of them prevent the stories people tell afterwards. Aim for a routine you will keep, not a perfect system you will abandon in a week.

Common mistakes

Reusing one password across several accounts.
Leaving old contractors with access.
Assuming backups exist without checking.
Adding third-party scripts because they were free.
Ignoring the browser warning on your own site.

Try this today

List every account that can edit your website and delete the ones nobody needs.
Turn on two-factor login for your site account and your email.
Ask your host how backups work and write the answer where you will find it.

Field notes

Most small sites are caught by automated sweeps, not targeted.
Secure connection, strong logins, updates and tested backups cover the basics.
Know who handles updates.
Fewer outside scripts means fewer surprises.
Check what you assume.

Prefer to hand the work off? Describe your business to websiites and review the finished site before choosing a plan. The pricing page lists what each plan includes.

Frequently Asked Questions — Everything you need to know about websiites.com: pricing, how the AI build works, domain setup, cancellation, and what happens if you’re not happy.
How It Works — See the full site before you pay.
Website Builder Pricing — Simple, transparent pricing for your AI-built business website.