Website Security for Small Business: Seven Habits That Matter More Than Software

Website security for small business sounds like a job for specialists with expensive tools. In our experience, the sites that get compromised are rarely targeted by a clever adversary; they are simply the ones where an update was missed, a sign-in was shared or an old plug-in was left behind. The National Cyber Security Centre's guidance for small organisations stresses the same basics. Here are seven habits that do most of the work.

Keep everything updated, on a schedule

Content management systems, themes, plug-ins and server software all receive security fixes, and attackers scan the internet for sites still running the vulnerable versions. Put updates in the calendar weekly, apply them to a test copy first for anything important and keep a note of what changed. Remove plug-ins and themes you do not use, because an inactive one that is still installed can be exploited.

Use two-step verification everywhere it exists

A stolen login is the way in for a great many incidents. Turn on two-step verification for your hosting account, domain registrar, content management system, email and any payment platform. Prefer an authenticator app or a hardware key over text messages where you can. Give each person their own account rather than a shared one, so you can see who did what and remove access the day somebody leaves.

Give people the least access they need

A marketing assistant who updates blog posts does not need to install plug-ins or see customer records. Most platforms offer roles; use them. Review the list of users every quarter, delete accounts that are no longer needed and check that administrators are genuinely administrators. Also review which third parties have access, such as freelancers and agencies, and whether that is still appropriate.

Serve everything over HTTPS and set sensible headers

Every page should load over an encrypted connection with a valid certificate that renews automatically. Redirect all plain requests to the secure address. Beyond that, a few response headers, such as one that tells browsers to use HTTPS only and another that limits where scripts can load from, provide inexpensive protection. Your developer will know them; ask them to confirm which are enabled.

Protect forms and logins from abuse

Limit the number of login attempts, add rate limiting to forms and use a reputable spam filter. Do not reveal in an error message whether an email address exists. Keep file uploads restricted to the types you genuinely need and store them outside the area where scripts can run. Validate everything that arrives on the server, not only in the browser.

Back up, and practise restoring

Security is partly about recovery. Keep automatic copies off the server, in a different account, and test the restore every quarter. If the worst happens, a clean backup turns a crisis into an inconvenience. Keep a short written plan with names and phone numbers, stored somewhere that is not the website itself.

Choose hosting with security in mind

Cheap shared hosting puts your site beside many others, and a problem with one neighbour can reach you. Ask what isolation, monitoring and patching the host provides, where data is stored and how they notify you of incidents. For businesses that want a recognised baseline, the UK's Cyber Essentials scheme sets out five technical controls, covering firewalls, secure configuration, user access, malware protection and security updates, and certification is a useful signal to customers who ask suppliers about their security.

What to do when something looks wrong

Signs of trouble include unexpected admin users, pages you did not create, visitors redirected to unfamiliar sites, a warning from a search engine or a sudden slow-down. If you suspect a compromise, do not simply delete things. Take a copy of the site for investigation, change the credentials for hosting, the content system, the database and email, restore from a known clean backup and patch the weakness that let the attacker in. Otherwise the same door stays open.

Tell the right people

If personal data may have been exposed, UK data protection rules expect you to assess the risk and, where required, report to the Information Commissioner's Office within 72 hours of becoming aware. Tell affected customers when the risk to them is high. Keep notes of what happened, what you decided and why, because that record shows you acted responsibly. Reporting a fraud or a cyber crime to the police through their national reporting service is also sensible.

None of this requires a large budget. It requires someone being responsible and a handful of recurring reminders. If you would like us to review your site against these seven habits, we can give you a plain list of what to fix first.