Website Security Checklist for Small Businesses (2026)

You get an email from a customer: “Your website is showing a security warning.” Or worse, a search for your business name shows spammy pages you never wrote. Suddenly, the website you built to bring in customers is sending them away.

Most small business owners don’t think about security until that moment. The good news is that a handful of habits stop most problems, and none of them need a security degree.

This website security checklist walks you through the essentials in plain language. Work through it once, then repeat the maintenance steps on a schedule.

Why Small Business Websites Get Attacked

Many attacks are automated. Programs scan the internet for sites with old software, weak passwords or missing protections, and they don’t care how big your business is. A small site with a forgotten plugin is as easy a target as a large one.

What you lose depends on the attack: customer data, search rankings, sales, or simply your reputation. Prevention is far cheaper than cleanup.

The Checklist at a Glance

Lock Down Your Logins

Stolen or guessed passwords are one of the easiest ways in. Fix this first.

• Turn on two-factor authentication (2FA). The UK’s National Cyber Security Centre (NCSC) advises enabling it on important accounts. Start with your email, hosting, domain registrar, and website admin login.

• Use a different password for every account. If one site leaks your password, attackers will try it everywhere else.

• Stop sharing one admin login. Create a separate account for each person, so you can remove access when someone leaves.

• Give least access. A blog writer doesn’t need admin rights.

Get Your SSL Certificate Right

An SSL certificate (technically TLS) encrypts the connection between your visitors and your site. It’s the reason you see https and a padlock. Without it, browsers warn visitors that your site is not secure.

Two things to know in 2026:

• Certificates now expire faster. Since March 15, 2026, publicly trusted certificates can last at most 200 days, down from 398. The approved schedule drops to 100 days in March 2027 and 47 days in March 2029.

• Automation matters. Let’s Encrypt, a free certificate authority, already uses 90-day certificates that renew automatically. If you buy a certificate, your provider may ask you to reissue it every 200 days.

Your checklist: install a certificate, redirect all HTTP pages to HTTPS, and make sure renewal is automatic or in your calendar. Also remember that SSL protects data in transit only. It does not make your site immune to hacking.

Keep Everything Updated

Updates fix known weaknesses. The NCSC’s small business guidance tells organizations to install the latest updates and switch on automatic updates where possible.

• Update your CMS (e.g., WordPress), plus themes and plugins.

• Turn on auto-updates for plugins you trust.

• Delete what you don’t use. A deactivated plugin can still be a risk. Remove old plugins, themes, and test pages.

• Keep your hosting’s PHP or server software on a supported version.

Back Up Like You Mean It

Backups turn a disaster into an annoying afternoon. NCSC guidance says to back up important data regularly, ensure backups are recent and restorable, and keep them separate from your working systems. It also recommends offline backups and scanning backups for malware before you restore.

• Automate it. Daily for busy sites, weekly for a simple brochure site.

• Store copies elsewhere. A backup on the same server dies with the server.

• Test a restore. An untested backup is a hope, not a plan.

A common rule of thumb is 3-2-1: three copies, on two types of storage, with one off-site.

Harden Your Hosting and Access

• Choose a host that offers security tools, such as a firewall, malware scanning, and backups.

• Use SFTP or SSH instead of plain FTP. Plain FTP sends passwords without protection.

• Add a web application firewall (WAF). It filters suspicious traffic before it reaches your site.

• Limit login attempts and hide or protect admin pages where your platform allows it.

Protect Forms, Payments, and Customer Data

• Use a payment provider’s hosted checkout. It keeps card details off your own server.

• Collect only what you need. Data you don’t store can’t be stolen.

• Add spam protection to forms and keep form plugins updated.

• Publish a clear privacy policy that explains what you collect and why.

Watch for Trouble

You can’t fix what you don’t see. Set up a light monitoring routine:

• Google Search Console. Its Security Issues report and Message panel flag hacking, malware, and phishing problems.

• Uptime alerts. Get a message if your site goes down.

• Regular malware scans through your host or a security plugin.

• Login alerts for admin accounts.

What to Do If Your Website Is Hacked

If your website is hacked, stay calm and move in order:

• Contain it. Contact your host and consider taking the site offline while you investigate. If you’ve lost admin access, your host can help you regain it.

• Check Search Console. Open the Message panel and Security Issues report. Google’s guidance says to check users and permissions too, because hackers sometimes add themselves as verified owners. If you see a phishing notification, keep the message until recovery is complete.

• Change every password and revoke unknown users and API keys.

• Find and fix the cause. Cleaning the symptoms without closing the hole just invites a repeat.

• Restore from a clean backup or remove malicious files, then update everything.

• Request a review from Google through Search Console if it flagged your site.

If customer data may have been exposed, check whether your local laws require you to report it, and tell affected customers.

Common Mistakes to Avoid

• Leaving the default admin account. Attackers try common usernames first. Use a unique admin name and remove accounts you don’t recognize.

• Letting the SSL certificate expire. Visitors see a full-page warning, and many leave. With shorter lifetimes, put renewal alerts in your calendar even if you automate it.

• Trusting a backup you never tested. Many owners find out a backup was empty or corrupted only after a disaster.

• Installing plugins from unknown sources. Download from the official directory or the developer’s own site, and check when it was last updated.

• Relying on the developer who built the site. Ask who owns the hosting, domain, and admin accounts, and make sure you hold the logins.

Your 30-Minute Starter Plan

Short on time? Do these five things today, in this order:

• Turn on two-factor authentication for email, hosting and your website admin.

• Check that your site loads on https and that the certificate renews automatically.

• Run all pending updates, then delete unused plugins and themes.

• Switch on automatic backups and confirm a copy is stored away from your server.

• Open Google Search Console and look at the Security Issues report.

Then come back and work through the rest of the checklist over the next week.

A Simple Maintenance Schedule

References

• NCSC, Small Business Guide: Actions

• NCSC, Offline backups in an online world

• SSL.com, SSL Certificate Validity Changes: What You Need to Know

• DigiCert, Shortened TLS/SSL Certificate Validity FAQ

• web.dev, Use Search Console (Help for hacked sites)