Access and accounts
- Use strong, unique passwords for admin, hosting and domain accounts.
- Turn on two-factor authentication wherever possible.
- Give each person their own login with only the access they need.
- Remove old users and former staff immediately.
- Change default admin URLs and limit login attempts.
Software and server
- Keep CMS, plugins, themes and server software updated.
- Delete unused plugins and themes.
- Use HTTPS everywhere.
- Add a web application firewall (WAF) to block common attacks.
- Set correct file permissions and disable directory listing.
Data, backups and monitoring
- Take automatic daily backups stored off-server.
- Test restoring a backup every quarter.
- Validate and sanitise all form inputs; protect forms from spam.
- Monitor uptime and run regular malware scans.
- Keep an incident plan: who to call and what to do if the site is hacked.
Our managed IT and website teams secure, monitor and back up business websites. Request a security check.
Frequently asked questions
Why would hackers target a small business website?
Most attacks are automated bots scanning for known weaknesses. Small sites are hacked to send spam, host malware or steal data.
How do I know if my website is hacked?
Signs include unknown admin users, strange redirects, spam pages in Google results, browser warnings or unexpected changes to files.
What is the most important security step?
Keeping all software updated and using strong passwords with two-factor authentication prevents the majority of attacks.
Talk to an expertEvery business is different. If you’re planning something similar, our team can review your requirement and suggest the right approach — free of charge. Contact us →