Website security for small businesses: the 12 checks that stop most attacks

Small businesses often assume hackers are not interested in them. In reality, most attacks are automated: bots scan millions of sites for known weaknesses and break into whichever ones are open. The good news is that the same few precautions stop most of them.

Here are the twelve checks we apply to every website we build.

Accounts and access

1. Strong, unique admin passwords. Use a password manager; never reuse a password from another service.
2. Two-factor login on the website admin, hosting panel, domain registrar and business email. A stolen password alone should not be enough.
3. Least access. Give each team member their own account with only the permissions they need, and remove accounts when people leave.
4. Limit login attempts. Rate-limit sign-ins so bots cannot guess passwords endlessly.

Software and server

5. Keep everything updated. Framework, plugins, libraries and the server itself. Most break-ins use vulnerabilities that already have a fix.
6. HTTPS everywhere with security headers that stop clickjacking and content sniffing.
7. Keep secrets secret. API keys and database passwords live in server environment settings — never in code or shared documents.
8. Close what you don't use. The database should not be reachable from the internet, and only necessary ports should be open.

Forms, uploads and content

9. Validate every input on the server. Never trust what a browser sends; check length, type and format.
10. Treat uploads as dangerous. Accept only the file types you need, check them by content rather than name, and re-process images.
11. Protect forms from spam bots with invisible checks and rate limits rather than annoying puzzles.

When something goes wrong

12. Automatic, off-site, tested backups. A backup you have never restored is a hope, not a plan. Keep copies away from the main server and test a restore every few months.

Don't forget email and domain

Set up SPF, DKIM and DMARC for your domain so nobody can easily send emails pretending to be you, and lock your domain at the registrar. Losing control of your domain or email is often worse than a website hack.

No website is ever "unhackable", but a site with these basics in place is far harder to break than the thousands of easier targets bots are looking for. Security is not a one-time project — review it every few months, and after every major change.