"Why would anyone hack a small business website?"
It is a common reaction, and it misses how most attacks work. Hackers rarely pick a target by name. Automated tools scan thousands of sites at a time looking for the same weaknesses: outdated software, weak passwords, forgotten logins. A small business site with a neglected setup is just as easy a target as a large one, and the cost lands on you: a warning in Google, a site that sends spam, or a week offline.
The good news is that a handful of habits prevent most problems. None of this needs technical skill, only a little discipline.
1. Use HTTPS everywhere
Your address should start with https:// and show no browser warning. Most hosts include a free certificate, so there is no reason to go without one. Check that visitors who type the old http:// address are redirected to the secure version.
2. Keep software up to date
Outdated plugins, themes and platforms are the most common way sites get compromised. If you use a system with plugins, update regularly and delete the ones you no longer use. If you are unsure who is doing this for you, read our guide to website maintenance after launch.
3. Use strong, unique passwords
Every login connected to your website needs its own long password: hosting, domain, website admin and business email. A password manager makes this painless. Reusing one password across services means a leak elsewhere can open your site.
4. Turn on two-factor authentication
Where hosting, your domain registrar, Google or your site admin offer a second step (an app code or a text message), switch it on. It is one of the most effective protections available and takes a couple of minutes.
5. Limit who has access
Review who can log in. A former employee, an old freelancer or a previous agency should not still have admin access. Give people only the level of access they need, and remove accounts when the working relationship ends.
6. Keep backups you can actually restore
A backup is only useful if it is recent, stored away from the site itself, and has been tested. Ask your host or developer how often backups run, how long they are kept and how quickly a site can be restored. If the answer is vague, that is worth fixing before something goes wrong.
7. Be careful with forms and customer data
Any form that collects names, emails or phone numbers should send them over HTTPS and only collect what you really need. Do not keep enquiries in an unprotected spreadsheet shared with everyone. Data protection obligations apply to small businesses too, so see our overview of GDPR and cookie consent for Irish websites, and take advice from a professional on your specific situation.
8. Watch for warning signs
Act quickly if you notice:
- Your site redirects visitors somewhere unexpected
- Pages or links you did not create
- A Google warning such as "This site may be hacked" in search results
- Customers reporting spam emails that appear to come from your domain
- Login emails or password resets you did not request
If any of these appear, change your passwords, contact your host and developer, and restore from a clean backup.
What a safer setup looks like
Some platforms are simply easier to keep safe. A site built without a pile of third-party plugins has fewer doors to lock, and a well-run host handles server-level security for you. When we build business websites, we keep the number of moving parts low for exactly this reason. Whatever you choose, make sure someone is clearly responsible for updates, backups and access, because security that belongs to nobody gets neglected.
Final thought
Website security is mostly routine: HTTPS, updates, strong passwords, two-factor authentication, tidy access and tested backups. Spend an hour this week going through the eight points above, write down who is responsible for each, and you will be ahead of most small business sites.
