To secure a small business website, protect every login with strong unique passwords and two-factor authentication, keep your CMS, plugins and hosting software updated, remove anything you don't use, serve the whole site over HTTPS with security headers, and keep automatic off-site backups you have actually tested restoring. Most attacks on small sites exploit one of these gaps.
This checklist puts those steps in priority order, with what to do on WordPress and typical shared hosting, and what to hand to your developer or host.
Key takeaways
- Protect every login with a unique password from a password manager and two-factor authentication, or passkeys where supported.
- Keep your CMS, plugins and themes updated, aiming to apply critical security updates within 14 days, and delete code you do not use.
- Serve the whole site over HTTPS with a single 301 redirect, and add security headers such as HSTS, nosniff and a Content-Security-Policy.
- Keep automatic daily off-site backups with at least 30 days of history, and test restoring them every few months.
Why would anyone attack a small business website?
Rarely because of who you are. Most attacks on small sites are automated: bots scan millions of sites for out-of-date plugins, default admin paths, leaked passwords and exposed configuration files. A compromised site is useful for sending spam, hosting phishing pages, redirecting visitors or skimming card details. The NCSC says half of small businesses suffer a cyber incident every year, and small organisations are "just as likely to experience online crime as larger ones".
The good news is that the same automation means the basics stop most attacks.
What should be on a small business website security checklist?
Work through these sections in order. The first two prevent the majority of real-world compromises.
1. Lock down every login
- Use a password manager and a unique, long password for the CMS admin, hosting control panel, domain registrar, DNS provider and any CDN.
- Turn on two-factor authentication (2FA) everywhere it is offered, or passkeys where supported. The NCSC now recommends passkeys wherever a service supports them and two-step verification where it doesn't.
- Give each person their own account. Shared logins make it impossible to remove one person's access.
- Use the lowest role that does the job: editors don't need administrator rights.
- Remove accounts for former staff, freelancers and agencies as soon as work ends.
2. Keep everything updated
- Turn on automatic updates for your CMS core and, where safe, plugins and themes.
- Check weekly for updates that need manual approval. Cyber Essentials requires critical and high-risk security updates to be applied within 14 days, which is a sensible target even if you are not certifying.
- Make sure your host runs a supported PHP version. Ask them if you're unsure.
- Delete plugins and themes you don't use. Deactivated code can still be exploited.
3. Encrypt traffic and harden the browser side
- Install a TLS certificate (free from your host or Let's Encrypt) that covers both
wwwand the bare domain, and renews automatically. - Redirect every HTTP URL to HTTPS with a single 301.
- Fix mixed content so no resource loads over HTTP.
- Add security headers: HSTS,
X-Content-Type-Options: nosniff, a Content-Security-Policy andframe-ancestorsto stop clickjacking. Our HTTP security headers guide explains each one. - Mark session cookies
Secure,HttpOnlyandSameSite.
A starting header set for Apache looks like this; test on a staging site before going live, because a strict CSP can break scripts:
Header always set Strict-Transport-Security "max-age=31536000"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Content-Security-Policy "frame-ancestors 'self'; upgrade-insecure-requests"
The free security headers generator builds the equivalent for Nginx.
4. Hide what should never be public
- Make sure
/.env,/.git/, backup ZIPs and database dumps are not downloadable from your web root. Our guide to exposed .env and .git files shows how to check and block them. - Turn off directory listing and detailed error messages on the live site.
- Remove old staging copies, test installs and forgotten subdomains.
5. Back up and plan for the worst
- Take automatic daily backups of files and database, stored away from your hosting account.
- Keep at least one copy your web host can't delete, such as cloud storage with versioning.
- Do a test restore at least every few months.
- Write a one-page plan: who to call (host, developer), where backups live, and how to reach your registrar.
Keep enough history to go back before a compromise was noticed: at least 30 days of daily copies is a sensible minimum.
6. Protect the domain and DNS
- Turn on registrar lock and 2FA at your registrar.
- Keep the domain on auto-renew with a payment card that won't expire unnoticed.
- Add a CAA record to limit which certificate authorities can issue for your domain, and consider DNSSEC.
- Publish SPF, DKIM and DMARC so criminals can't easily send email as your domain.
7. Add a protective layer at the edge
- Consider a CDN with a web application firewall and DDoS protection. Cloudflare's free plan includes unmetered DDoS protection and a free managed WAF ruleset; most other CDNs and many hosts offer equivalents.
- Rate-limit login pages, or use your host's brute-force protection.
8. Watch for problems
- Register your site in Google Search Console and Bing Webmaster Tools; both alert you to detected security issues.
- Use an uptime monitor so you hear about outages before customers do.
- Re-scan your security configuration monthly, or after any big change. Paid MakeItFlow plans can schedule this and email you the report.
Which of these do I do myself, and which does my host do?
| Task | Usually you | Usually your host |
|---|---|---|
| CMS, plugin and theme updates | Yes | Some managed hosts |
| Server software, PHP, OS patches | Yes | |
| TLS certificate issue and renewal | Toggle on | Yes (AutoSSL) |
| Security headers | Yes, or your developer | Some hosts offer settings |
| Backups | Check and test | Often provided, but keep your own copy |
| Malware scanning | Many hosts include it | |
| 2FA on your accounts | Yes | Must offer it |
Ask your host three questions: how often they back up and for how long, whether they scan for malware, and whether the control panel supports 2FA. Their answers tell you which gaps are yours to fill.
How do I check whether my website is secure now?
MakeItFlow runs a free website security scan that checks the TLS certificate, HTTPS redirect, security headers, cookie flags, mixed content and exposed .env/.git files in one pass, with plain-English fixes. It doesn't scan for malware or monitor uptime, so pair it with your host's malware scanner and a separate uptime monitor. For a broader starting point, the NCSC's free Cyber Action Toolkit gives small businesses personalised steps that build towards Cyber Essentials.
What to do next
Spend an hour this week on sections 1 and 2: password manager, 2FA everywhere, and a clean-up of unused plugins and accounts. Next week, run a free website audit and work through any red items in the security section. Then book a test restore in your calendar, because a backup you've never restored is only a hope.
Frequently asked questions
Do I need Cyber Essentials for my website?
It isn't a legal requirement, but some public-sector and larger clients ask for it. Version 3.3 of the requirements took effect on 27 April 2026, and its controls on updates, MFA and access overlap heavily with this checklist. Cyber Essentials is a UK scheme; in the US, the free CISA Cyber Essentials Starter Kit covers similar ground as guidance rather than a certification.
Is WordPress less secure than other platforms?
WordPress core is well maintained; most compromises come from out-of-date or abandoned plugins and weak admin passwords. Our WordPress security checklist covers the platform-specific steps.
Does a security plugin replace these steps?
No. A plugin can add 2FA, login limits and scanning, but it can't fix weak passwords elsewhere, forgotten admin accounts or a lapsed domain. Treat it as one layer.
How much should a small business spend on website security?
Most items here cost nothing beyond time: free certificates, built-in 2FA, free CDN tiers. Budget mainly for good hosting with backups, and an hour a month of maintenance from you or your developer.
What should I do if my website has already been hacked?
Take the site offline or into maintenance mode, change every password, contact your host, and restore from a clean backup taken before the compromise. Then patch whatever let the attacker in, or it will happen again.
Related reading
- Website Security Threats 2026: A UK Small Business Guide: The biggest website security threats for UK small businesses in 2026, backed by government breach data, plus a practical checklist to cut your risk this month.
Sources
More guides for your industry
Free checklist (PDF)
Free accountants website checklist
31 practical checks for accountants: website speed and mobile, Google Business Profile and reviews, email security, booking and enquiry handling, and AI search visibility. Each one says why it matters, and many link to a free tool that checks it.
Written by the MakeItFlow team
We build the website audit these guides are based on. Every fact is checked against the primary sources listed above and this guide was last reviewed on 25 October 2026 . How we research and check
Check your own site in 30 seconds
Run a free audit covering speed, SEO, DNS, email authentication and security headers — and get a prioritised fix list.
