Website security checklist for small business

A practical security checklist: SSL, backups, updates, strong logins and the basics that stop most attacks on small business sites.

A1 Digital · written & reviewed by the team 5 July 2026 4 min read Updated 5 July 2026

Quick answer

A website security checklist for a small business covers the essentials that stop most attacks: an SSL certificate, automatic software updates, strong passwords with two-factor login, regular off-site backups, and a managed host that monitors for threats.

43%

of cyber attacks target small businesses

Source: Verizon DBIR

Free

SSL certificates via Let's Encrypt or your host

Daily

how often a business site should be backed up off-site

The myth that keeps small businesses exposed is “nobody would bother hacking us, we’re too small”. It misunderstands how website attacks actually work. Nobody picked you. A bot scanned millions of sites looking for one weak spot and yours had it. Being small is no protection at all, but the flip side is genuinely cheering: a handful of basics blocks the overwhelming majority of these automated attacks. Here’s the checklist, in plain English.

A website security checklist for a small business has nine essentials: install an SSL certificate (HTTPS), keep all software updated, use strong passwords with two-factor login, take daily off-site backups, limit admin access, add a firewall and malware scanning, secure your forms, keep your domain and hosting accounts locked down, and have a recovery plan.

The 9-point checklist

SSL certificate (HTTPS). Encrypts data between your visitor and your site and shows the padlock. Free through most hosts and Let’s Encrypt, and browsers now warn visitors away from sites without it. See what an SSL certificate actually does.
Keep software updated. WordPress, plugins, themes and your server software all get security patches. Outdated plugins are the single biggest cause of small business hacks. Turn on automatic updates where you can.
Strong passwords + two-factor (2FA). Use a unique, long password for every admin account and a password manager to store them. Add 2FA so a stolen password alone can’t get anyone in.
Daily off-site backups. Back up files and database daily to a location separate from your host. A backup on the same server is worthless if that server’s compromised. Here’s why backups matter.
Limit admin access. Only give admin rights to people who genuinely need them. Remove old staff and freelancers the day they leave. Use editor or author roles for everyone else.
Firewall + malware scanning. A web application firewall (WAF) blocks malicious traffic before it reaches your site, and a scanner flags infected files early.
Secure your forms. Add spam protection and rate limiting to contact and booking forms, and never email yourself raw form data over an unencrypted connection.
Lock down domain and hosting accounts. Your domain registrar and hosting login are the keys to everything. Put 2FA on both and enable domain lock to stop your domain being transferred away.
Have a recovery plan. Know who to call, where your backups are, and how to take the site offline if it’s compromised. The time to work this out is before something goes wrong.

Key takeaway

Updated software, strong logins with 2FA, and daily off-site backups stop the large majority of small business website attacks. If you only do three things, do those three.

Why small sites are targeted

It feels counter-intuitive: why would anyone bother with a five-page plumber’s website? Because they aren’t targeting you specifically:

Automated scanning. Bots probe every site they can find for known weaknesses, regardless of size.
Resale value. A hacked site can be used to send spam, host phishing pages, mine cryptocurrency, or attack other sites.
Weak defences. Small businesses are statistically less likely to have backups, updates or monitoring in place, which makes them easier targets than large companies.

The hidden cost isn't just the hack

The real damage is downtime, lost enquiries, Google flagging your site as “deceptive”, and the days it takes to clean up. Prevention is far cheaper than recovery.

What “secure” looks like in practice

A securely run small business site quietly does all of this in the background:

Area	Risky setup	Secure setup
Login	Shared password, no 2FA	Unique password + 2FA per user
Updates	Done 'when we remember'	Automatic, monitored
Backups	None, or on the same server	Daily, off-site, tested
Hosting	Cheap shared box, no firewall	Managed host with WAF + scanning

If that table makes your stomach drop, you’re not alone. Most owners don’t have time to babysit updates and test backups, which is exactly why these tasks get skipped until something breaks.

Who keeps it maintained?

Security isn’t a one-off task. Software gets new patches every week, and a site that was locked down a year ago can be wide open today. Someone has to keep up.

This is part of what we handle for clients: managed hosting with SSL, automatic updates, daily off-site backups, a firewall, and monitoring all included so you never think about it. See what’s covered in each plan or get in touch to talk through your current setup.

Actually test a restore

Test a backup restore at least once. Plenty of businesses discover their “backups” were never working only when they need them most.

Security overlaps with your legal duties too. If you collect any personal data, the way you store and protect it matters, so it’s worth reading up on GDPR for websites alongside this checklist.

Work down the nine points and mark each one done, partly done, or missing. Fix the gaps in the missing column first, starting with updates, logins and backups. If you’d rather not manage it yourself, hand the whole list to someone who does it for a living and get on with running your business.

Frequently asked questions

Do small business websites really get hacked?

Yes, more often than owners expect. Most attacks are automated bots that scan the whole internet for sites running outdated software or weak passwords, so they don't care how small you are. A simple brochure site with no payments can still be hijacked to send spam or host scam pages.

Is an SSL certificate enough on its own?

No. An SSL certificate encrypts data between your visitor and your site and gives you the padlock and HTTPS, which is essential. But it does nothing to stop outdated plugins, weak passwords, or missing backups. Treat SSL as one item on the checklist, not the whole list.

How often should I back up?

Daily for any site that changes regularly, and always to an off-site location separate from the host. If your only backup lives on the same server and that server's compromised or fails, the backup goes with it. Test a restore occasionally so you know the backup actually works.

What's the single most important thing?

Keep your website software updated and use a strong, unique password with two-factor authentication on the admin login. Outdated software and weak logins are behind the majority of small business website breaches, so fixing those two closes most of the door.

website security ssl backups small business maintenance

Share Link copied

Written by the A1 Digital team

We handle the entire online presence for small businesses, website, branded email, Google, AI search, content and reviews, for one simple monthly plan. No tech headaches, no lock-in.

View plans Contact us

Keep reading

Definition