Web Security Checklist for Small Business Sites

Attackers rarely target small businesses by name. They run automated scans against thousands of sites and take the ones with outdated software, weak passwords or open forms. A short, consistent checklist blocks most of this. Use the list below as a quarterly review for your site.

1. Use HTTPS everywhere

• Install a valid certificate and redirect all HTTP traffic to HTTPS.
• Enable HSTS so browsers refuse to load the site over plain HTTP.
• Check that images and scripts do not load from HTTP addresses, which causes mixed-content warnings.

2. Keep software updated

Outdated plugins, themes and frameworks are the most common way sites are hacked. Update the CMS, plugins and dependencies on a schedule. Remove anything you no longer use. For code projects, run npm audit or a dependency scanner in your pipeline and review the results.

3. Fix passwords and access

• Use a password manager and unique passwords for hosting, domain, email and admin accounts.
• Turn on two-factor authentication for every account that supports it, especially your domain registrar and hosting panel.
• Give each person their own login and remove access when someone leaves.
• Do not use "admin" as a username, and limit login attempts.

4. Back up and test the restore

A backup you have never restored is a hope. Keep daily backups of files and the database, store copies away from the server and try a restore into a test environment at least twice a year. Backups are the only reliable recovery from ransomware or a failed update.

5. Add security headers

• Content-Security-Policy limits where scripts can load from, which reduces cross-site scripting damage.
• X-Content-Type-Options: nosniff stops browsers from guessing file types.
• Referrer-Policy controls what URL data you share with other sites.
• X-Frame-Options or frame-ancestors prevents clickjacking.

Test your site with a header scanner and fix the gaps one at a time.

6. Protect forms and APIs

• Validate and sanitize every input on the server, not only in the browser.
• Use parameterized queries to prevent SQL injection.
• Rate-limit contact forms, login and OTP endpoints and add a bot check such as a honeypot field or CAPTCHA.
• Never expose API keys in front-end code. Keep secrets in environment variables.

7. Limit what an attack can reach

Give the database user only the permissions the app needs. Disable directory listing, hide server version details and keep admin panels behind an IP restriction or extra authentication. If one part is compromised, the rest should stay out of reach.

8. Watch for trouble

• Set up uptime monitoring and alerts.
• Review logs for repeated failed logins and unusual traffic spikes.
• Check Google Search Console for security issues and unexpected pages.

9. Have a response plan

1. Know who to call: your developer, host and domain provider.
2. Take the site offline or into maintenance mode if it is serving malware.
3. Change all passwords and keys, then restore from a clean backup.
4. Find and close the entry point before going live again.

Quick quarterly routine

Once a quarter, update everything, review user accounts, test one backup restore, run a header scan and read the logs. It takes about two hours and prevents most incidents. Online stores need more, as covered in our guide to e-commerce security.

What an attack looks like in practice

Most small-site incidents follow a simple path. A bot finds an outdated plugin, uses a known flaw to upload a file, and the site starts redirecting visitors or sending spam. Another common one starts with a reused password from an old data leak, which the attacker tries on your admin panel. Neither needs skill, only a site that nobody checked. The checklist above breaks that chain at the first step.

Questions owners ask us

• Is a security plugin enough? It helps, but updates, strong passwords, two-factor login and tested backups matter more.
• Does a small site really get targeted? Yes, by automated scans. Size does not matter to a bot.
• How often should we review? Quarterly for the checklist, and immediately after any staff change.

Security built into the tools we make

Business software holds money and customer data, so security cannot be an afterthought. Our Lena Dena platform uses role-based access, so owners, admins, accountants, sales staff and viewers see only what their job needs, and it keeps team members' actions separate from the owner's. Messaging brings its own risks: our WhatsApp assistants verify webhook signatures, keep tokens in environment variables, and avoid writing message text into logs. The ideas are the same as in this checklist, applied to the channels your customers actually use. Whatever you run, assign one person to own the checklist, put the quarterly review in the calendar and keep a short log of what changed, so the next review starts from facts instead of memory. See the WhatsApp automation project for a real example.

We build and harden business websites and web apps. Explore our services or contact us for a security review.