Website security basics every business owner should know

Many owners think, "Who would bother hacking my little website?" The honest answer is: nobody in particular. Most attacks are automated. Bots scan millions of sites looking for old software, weak passwords and open doors. They do not care whose site it is, only whether it is easy.

The good news is that the basics stop most of these attacks. Here is what every owner should check, even if someone else built the site.

1. HTTPS everywhere

Your address should start with https:// and show a padlock. HTTPS encrypts what travels between the visitor and your site, including anything typed into forms. Browsers warn visitors about sites without it, and certificates are available for free, so there is no reason to go without.

2. Keep software updated

Many sites are built on a content management system plus themes and plugins. Each piece gets security updates when holes are found, and bots specifically look for sites that have not applied them.

• Apply updates promptly, or make sure whoever maintains your site does.
• Remove plugins and themes you do not use. Unused code is still attackable.
• Be wary of "free" premium plugins from unofficial sources. They sometimes come with malware built in.

3. Strong logins, and two-step verification

• Use a unique, long password for your website admin, hosting, domain and email accounts. A password manager makes this easy.
• Turn on two-step verification wherever it is offered, especially for email, your domain registrar and hosting. Whoever controls your email can usually reset every other password.
• Give each person their own login with only the access they need, and remove access when someone leaves. Never share one admin password around the team.

4. Backups you have actually tested

Backups are your safety net against hacks, mistakes and server failures.

• Back up the site and its database automatically, at least daily for sites that change often.
• Keep copies somewhere other than the same server.
• Test a restore now and then. A backup you have never restored is a hope, not a plan.

5. Protect your forms

Contact and booking forms are a common target for spam and abuse.

• Use spam protection and limits on how often a form can be sent.
• Check and clean what people type before storing or displaying it.
• Never ask for sensitive details (card numbers, passwords, ID numbers) through an ordinary form.

6. Treat customer data with care

If your site collects personal information, you are responsible for it.

• Collect only what you need, and delete what you no longer need.
• Limit who on your team can see it.
• Encrypt sensitive information, and keep payment handling with a proper payment provider rather than on your own server.
• Publish a clear privacy policy that says what you collect and why. In India, the Digital Personal Data Protection Act sets out duties for businesses that handle personal data.

7. Know who owns what

Make sure you own your domain, hosting account and admin logins, not just the developer (why this matters). If something goes wrong and you cannot reach them, you need to be able to act.

If something goes wrong

Signs of trouble include strange pages or links appearing, browser warnings, unexpected redirects, or a sudden drop in search traffic.

1. Change passwords for the website, hosting, domain and email straight away, from a clean device.
2. Contact your developer or host.
3. Restore from a clean backup, then find and close the hole that let the attacker in, or it will happen again.
4. If customer data may have been exposed, take advice on your legal duties to inform people.

How we build

On the systems we build, security is part of the design rather than an add-on: encrypted connections, two-step verification for admin accounts, permissions checked on the server for every action, secrets encrypted at rest, a log of important changes, and automated backups. You do not need to know the technical details. You only need to know to ask your developer about these points, and to expect clear answers.