# Website security for small businesses: the basics that stop most attacks

> A plain guide to website security for small businesses: the common ways sites get hacked, the basics that prevent most of them, what to ask your web provider and what to do if it happens.

- Source: https://nerdsharks.com/blog/website-security-small-business
- Publisher: Nerdsharks (Exeter, Devon, UK)
- Updated: 2026-09-26

**Short answer:** Most small business websites are hacked through out-of-date software, weak or reused passwords, or abandoned plug-ins, not targeted attacks. The basics that stop most of it are keeping everything updated, strong unique passwords with two-step verification, removing old logins and plug-ins, HTTPS everywhere, locked-down domain and email accounts, monitoring and tested backups you can restore.

Published 2026-09-26. 9 min read. Category: Website advice.

Business owners often assume nobody would bother hacking a small website. The truth is that almost nobody does it on purpose. Automated tools scan the internet around the clock looking for known weaknesses: an old version of a plug-in, an admin login with the password “password1”, a forgotten test site. When they find one, they break in, whatever the business.

The good news is that the same automation means a few basic habits prevent most attacks. This guide covers website security for small businesses in plain terms, drawing on the National Cyber Security Centre’s small business guidance: what goes wrong, what to do about it, and what to ask whoever looks after your site.

## How small business websites actually get hacked

**Common website attacks and how to prevent them**

| How it happens | What it looks like | Main prevention |
|---|---|---|
| Out-of-date CMS, theme or plug-in with a known flaw | Spam pages appear, visitors are redirected, Google shows a warning | Apply updates promptly; remove unused plug-ins |
| Weak or reused admin password | Unknown admin users, defaced pages | Long unique passwords and two-step verification |
| Former staff or old developer still has access | Unexpected changes, lost control | Remove accounts when people leave |
| Compromised email account | Password resets hijacked, domain transferred away | Two-step verification on email and registrar |
| Form abuse and spam | Inbox flooded, form used to send spam | Server-side validation and invisible spam protection |
| Nulled or pirated themes and plug-ins | Hidden backdoors, spam links | Only install software from the official source |
| Neglected hosting | Slow site, shared server compromised | Reputable managed hosting with patched servers |

## The basics that prevent most attacks

Most small business websites that get hacked run a popular content management system with a pile of third-party plug-ins. Each plug-in is code written by someone else, updated on their schedule, and some are abandoned by their authors. A site with thirty plug-ins has thirty separate things that need to stay patched. Before adding one, ask whether you really need it, whether it is actively maintained and whether a simpler option exists. Fewer moving parts means fewer ways in.

- Keep everything updated: the website platform, themes, plug-ins and the server software. Updates often fix security holes that attackers are already exploiting.
- Use long, unique passwords for every account and store them in a password manager. The NCSC recommends combining three random words as a simple way to create a strong one.
- Turn on two-step verification wherever it is offered: website admin, hosting, domain registrar, email and social media.
- Give each person their own login with only the access they need. Never share one admin password around the office.
- Remove users, plug-ins and themes you no longer use. Abandoned software stops receiving fixes.
- Serve the whole site over HTTPS with a certificate that renews automatically.
- Keep regular, automatic backups stored away from the website itself, and test restoring one.
- Monitor the site so you know within minutes, not weeks, if it goes down or changes unexpectedly.

## Protect the accounts around your website

Your website is only as secure as the accounts that control it. The three that matter most are your domain registrar, your hosting account and your business email. Whoever controls the domain controls where your website and email point. Whoever controls your email can reset every other password.

Make sure these accounts are in your business’s name, use an email address you control, and have two-step verification switched on. Turn on registrar lock (sometimes called transfer lock) so the domain cannot be moved without extra checks. And keep a record, somewhere safe and offline, of which company holds each account.

> If you do not know who your domain is registered with or which email address controls it, find out this week. It is the single most common way small businesses lose control of their website.

## Email security and your domain

Criminals often send emails pretending to be from a business, for example fake invoices with changed bank details. Three DNS settings on your domain, called SPF, DKIM and DMARC, help email providers tell your genuine emails from forgeries. They also stop your own website’s form notifications landing in spam. Your email or website provider can set them up; it is a short job with lasting benefit.

## Questions to ask your web provider

Vague answers to these questions are a warning in themselves. A good provider can answer every one in a sentence.

- Who applies software updates, and how quickly after they are released?
- How often is the site backed up, where are the backups stored and when was a restore last tested?
- Is the site monitored for downtime and unexpected changes, and who gets alerted?
- Who has admin access right now, and how are old accounts removed?
- Is the domain in my business’s name, and is registrar lock on?
- What happens, and what does it cost, if the site is hacked?
- Is the hosting kept patched, and is it isolated from other customers’ sites?

## Cyber Essentials: is it worth it?

Cyber Essentials is a government-backed certification that covers five basic controls: firewalls, secure configuration, user access control, malware protection and security updates. It covers your business IT generally, not just the website. Some public sector and larger private contracts require it. For a small business it is a structured way to check the basics, and the NCSC’s free Small Business Guide covers much of the same ground.

Whatever you decide about certification, remember that the website is only one part of your security. The same habits that protect it, such as updates, unique passwords, two-step verification and backups, protect your laptop, phone, accounting software and email. Attackers often get into a website through a compromised email account or a reused password from another service, so treating security as one job rather than several is more effective.

## What to do if your website is hacked

- Do not panic, and do not just delete the spam you can see; attackers usually leave backdoors.
- Change passwords for the website, hosting, domain and email, starting with email, and turn on two-step verification.
- Contact your web provider or a specialist to clean the site properly or restore a clean backup from before the attack.
- Update everything, and remove the plug-in or account that let them in.
- Check Google Search Console for security warnings and request a review once the site is clean.
- If customer data may have been exposed, consider whether it is a reportable breach; the ICO requires serious breaches to be reported within 72 hours.
- Report cyber crime to Action Fraud, and use the NCSC’s guidance for recovering.

## Security checklist

All of this is part of looking after a website, not an optional extra. Nerdsharks sites include hosting, SSL, 24/7 uptime monitoring and daily backups as standard, with updates handled for you. Whatever your setup, the checklist above is the minimum to expect.

- Platform, theme and plug-ins up to date.
- Unused plug-ins, themes and accounts removed.
- Unique passwords and two-step verification on website, hosting, registrar and email.
- Domain in your business’s name with registrar lock on.
- HTTPS everywhere with automatic renewal.
- Automatic off-site backups, with a tested restore.
- Uptime and change monitoring with alerts.
- SPF, DKIM and DMARC set up on your domain.

## Questions

### Why would anyone hack a small business website?

Most small business websites are hacked by automated tools, not people targeting them specifically. Attackers want a foothold to send spam, host phishing pages, redirect visitors or boost their own search rankings, and any site with a known weakness will do. That is why basic maintenance matters so much.

### How do I know if my website has been hacked?

Signs of a hacked website include pages you did not create, visitors being redirected elsewhere, a browser or Google warning, unknown admin users, strange emails being sent, or a sudden drop in search traffic. Google Search Console reports security issues it detects, so make sure it is set up.

### Is WordPress secure for a small business?

WordPress itself is actively maintained and can be secure, but many hacked small business sites run on it because it is so widely used and often left with out-of-date plug-ins and themes. A well-maintained WordPress site with few, reputable plug-ins is reasonably secure; a neglected one is a common target.

### Does an SSL certificate make my website secure?

An SSL certificate encrypts the connection between visitors and your website, which protects form data in transit and removes “Not secure” warnings. It does not stop hackers exploiting out-of-date software or weak passwords. You need HTTPS and the other basics together.

### Should I get Cyber Essentials certification?

Cyber Essentials is worth getting if customers or contracts require it, or if you want a structured check of your basic IT security. It covers your wider business IT, not just your website. For many small businesses, following the NCSC’s free Small Business Guide is a sensible first step.

## Sources

- Small Business Guide: Cyber Security, National Cyber Security Centre, 2026: https://www.ncsc.gov.uk/collection/small-business-guide
- Cyber Essentials, National Cyber Security Centre, 2026: https://www.ncsc.gov.uk/cyberessentials/overview