Small business websites are hacked every day — not because attackers pick on a particular shop, but because automated bots scan the internet for easy targets: an outdated plugin here, a weak admin password there. If your site runs a CMS such as WordPress or an e-commerce platform such as OpenCart, most of that risk can be removed with a handful of basic habits. As an IT and Digital Operations Manager who also runs an e-commerce store, I have seen how a few simple steps keep a website running quietly instead of going down on a busy sales day. Here they are.

Start with HTTPS and an SSL certificate

HTTPS is the encrypted version of the web. When your site uses it, data passing between your visitors and your server — login details, contact form submissions, checkout information — is encrypted in transit. Without it, that data can be intercepted, and browsers warn visitors away from sites that do not have it. Most hosting providers include a free SSL certificate, and many control panels let you enable it in a few clicks. Once active, check that every page loads over HTTPS and that old HTTP links redirect to the secure version — one of the simplest wins in website security, and a trust signal too, since customers are less likely to buy from a checkout page that looks insecure.

Use strong passwords and two-factor authentication

Weak and reused passwords remain one of the most common ways attackers get in. Brute-force bots try thousands of combinations against admin login pages around the clock, and a short or predictable password will eventually fall.

• Use a long, unique password for every account — admin panel, hosting, email and database should each have their own. A password manager makes this manageable.
• Change the default admin username — if your CMS ships with "admin", change it. Half of the attacker's job is knowing the username.
• Turn on two-factor authentication (2FA) — a second code from your phone means a stolen password alone is not enough.
• Never share the main admin login — give staff or developers their own accounts with only the access they need, and remove accounts when people leave.

Keep your CMS, themes and plugins updated

Most CMS-based hacks do not come from the core software itself. They come from outdated themes and plugins with known vulnerabilities that were already fixed in a later release — but only if the site owner installs it. Set aside time each week to check for updates and apply them promptly. Before updating, take a backup, and check afterwards that your site still works.

Remove what you do not use

Every installed plugin is a potential entry point, even if it is disabled. Delete plugins and themes you no longer use, and if a plugin has not been updated by its developer for a long time, look for a maintained alternative.

Back up your website — and test the backup

A backup is your safety net for almost everything: a hack, a failed update, a hosting failure or a simple mistake. Without a recent backup, recovering from an incident can mean rebuilding a site from scratch.

• Back up both the files and the database — the files hold your theme, images and plugins; the database holds your products, orders and content.
• Keep backups off the server — store a copy in cloud storage or another separate location, so a compromised server cannot also destroy your only backup.
• Back up regularly — an online store taking orders needs backups far more often than a static brochure site.
• Test the restore — a backup you have never tested is a hope, not a plan. At least once, confirm you can actually restore from it.

Limit who can access the admin area

Your admin panel is the most valuable target on your website. Give each person the lowest level of access that lets them do their job — editors and shop staff rarely need full administrator rights. Limit login attempts so an address is blocked after several failures, review the user list for accounts you do not recognise, and use a separate email address for admin accounts.

Add a firewall and basic malware monitoring

A web application firewall, often called a WAF, sits in front of your website and blocks common attack patterns — such as injection attempts and known malicious requests — before they reach your server. Many hosting providers include a basic firewall, and there are also well-established firewall services and plugins for common platforms. Alongside it, monitor your site so you find out about problems quickly:

• Scan regularly for malware — run scheduled scans of your site's files and investigate unexpected changes.
• Watch your login activity — check for logins from unfamiliar locations or at unusual hours.
• Monitor uptime — a site that goes down or redirects visitors elsewhere is often the first visible sign of a compromise.

What to do if your website is compromised

Even with good habits, incidents happen. If you suspect your site has been hacked:

• Take the site offline or into maintenance mode — this protects your visitors while you work on it.
• Change all passwords — admin, hosting, database and email passwords should all be reset from a clean device.
• Restore from a clean backup or clean the infection — a backup from before the compromise is often the fastest reliable route. Otherwise, remove the malicious files and close the vulnerability that let the attacker in.
• Update everything and review your settings — apply pending updates, remove unknown admin accounts, and check for hidden files or redirects.
• Tell your customers if their data was affected — honesty about a breach protects trust far better than silence, and you may have legal obligations to notify people.

Frequently asked questions

Do small business websites really get targeted by hackers?

Yes. Most attacks are automated: bots scan the internet for sites running outdated software or weak passwords, regardless of the size of the business. A small site is often an easier target because it may not have dedicated security staff.

Is a free SSL certificate good enough for a small business site?

For most small business websites, a standard SSL certificate — including the free certificates many hosts offer — provides the same encryption as a paid one. What matters is that HTTPS is active on every page, especially login and checkout.

How often should I back up my website?

It depends on how often your site changes. A site that takes daily orders or publishes new content regularly should be backed up daily; a mostly static site can be backed up less often.

Closing thoughts

Website security is not a one-off project; it is a set of small habits repeated regularly. Enable HTTPS, use strong unique passwords with two-factor authentication, keep everything updated, back up often and store the backups safely, limit admin access, and keep an eye on your site's health. None of these steps is complicated on its own, and together they close the gaps most automated attacks rely on. The sites that stay secure are the ones whose owners treat security as routine maintenance rather than an afterthought.