Website Security Basics for Small Businesses (2026)

Website security can feel like a topic for big companies with security teams. In practice, small sites face the same automated attacks, and a few simple habits block most of them. Use this page as a checklist and work through it once a year.

1. Use HTTPS on every page

HTTPS encrypts the connection between your site and its visitors and removes the browser's "Not secure" label. Certificates are free from most hosts. Make sure every http:// address redirects to https://. Step-by-step help: why your website says Not secure.

2. Keep software up to date

Content management systems such as WordPress, and their themes and plugins, publish security fixes all the time. Outdated plugins are one of the most common ways into a small site.

• Turn on automatic updates for security releases.
• Delete plugins and themes you do not use.
• Never install "free" copies of paid plugins.
• Ask your host to keep the server's PHP or runtime version on a supported release.

3. Lock down logins

• Use a password manager and a unique, long password for each account.
• Turn on two-factor login (or passkeys) for hosting, domain registrar, website admin and email.
• Give each person their own account with only the access they need, and remove old staff and agency accounts.

4. Keep backups you have tested

A backup you cannot restore is not a backup. Keep automatic daily backups of files and the database, store copies away from the web server, and try a restore now and then. The common "3-2-1" rule is a good target: three copies, on two kinds of storage, with one off-site.

5. Watch for warning signs

• Verify your site in Google Search Console, which emails you about security issues it finds.
• Use a free uptime monitor that also warns before your certificate expires.
• Search Google for site:yourdomain.com every few months and look for pages you did not create.

If something looks wrong, our guide on what to do when a website is hacked explains the first steps.

6. Protect the domain and email too

• Turn on auto-renew and registrar lock for your domain name. A lapsed domain takes the site and your email offline at once.
• Set up SPF, DKIM and DMARC records for your email domain. Since 2024, Google and Yahoo require them from bulk senders, and they make it harder for others to send fake email in your name.
• Protect your contact forms from spam with a simple challenge or a hidden field.

What changed recently

• Shorter certificates. Public SSL/TLS certificates can now last at most 200 days, falling to 100 days in March 2027 and 47 days in March 2029, under rules agreed by the CA/Browser Forum in 2025. Manual renewals will not keep up; see what to do when a certificate expires.
• No more expiry emails from Let's Encrypt. It stopped sending certificate expiry reminders in 2025. Set up your own monitoring.
• Browsers pushing harder on HTTPS. Google announced that from Chrome 154 (October 2026), Chrome by default asks for permission before first opening a public site without HTTPS.
• Mobile-first everything. Google now indexes all sites with its smartphone crawler, so a broken mobile layout can hide content from search. See fixing a site that is not mobile-friendly.

Write a one-page plan

Write down where the site is hosted, who controls the domain and DNS, where backups live, and who to call if something breaks. Keep it somewhere you can reach even if your email is down. In a crisis, that page saves hours.