Website Security Basics: Protecting Your Site (and Reputation) From a Hack

22 September 2026·5 min read

Quick answer: Most website hacks aren't sophisticated — they're one weak login, one forgotten access point, or one plugin nobody updated in two years. You cut most of that risk with four habits: real backups, two-factor authentication everywhere, knowing who holds your domain login, and keeping your platform updated. It won't make you unhackable, but it makes you a much less appealing target. 🚀

Here's a sentence we hear constantly, usually right after something's gone wrong: "I just assumed the web guy handled that." Website security sits in a weird no-man's-land between "technical stuff" and "someone else's job," and most businesses only work out who was meant to be watching it once the site's already been defaced or hijacked. The good news is securing a small business website doesn't need an IT department — it needs five minutes and some honesty about what you don't currently know 💖.

What most businesses get wrong

Security gets treated as a one-time setup task instead of an ongoing responsibility with someone's name attached to it. A site gets built, launched, and never touched again — nobody's confirming backups run, nobody's reviewing who still has admin access, and update notifications get dismissed because "it's working fine right now." Businesses also assume hackers are targeting them personally, when most small business attacks are automated bots scanning the internet for known, unpatched weak spots. You're not being hunted, you're being opportunistically picked off because a door was left unlocked — so the fix isn't outsmarting anyone, it's not being the easiest house on the street.

The 5-minute security audit (copy this and actually do it today)

Grab whoever manages your website and go through this in order. You're checking yes or no, not writing a policy.

Backups: Are automated backups switched on, and do you know exactly where to find one right now?
2FA: Is two-factor authentication on for your website admin, domain registrar, hosting account, and the email tied to all three?
Domain access: Do you personally know which login controls your domain, and could someone at the business get in today if needed?
Updates: Is your CMS and everything plugged into it kept current, and by whom?
User access: Log into your admin panel and check "users" — do you recognise every single account listed?

Bonus — the first hour after a suspected hack: screenshot what looks wrong before touching anything; change your admin password from a trusted device and turn on 2FA; check your latest backup exists before restoring anything; check your registrar and hosting logins separately for changes; then contact your host or developer with specifics, not a vague "help, we've been hacked."

Scored less than five out of five? Completely normal — now you know exactly where to start.

The overnight defacement: A local service business came in on a Monday to find their homepage replaced with spam content, traced to an outdated plugin nobody had touched in over a year. With no working backup, the site had to be rebuilt from scratch — a full week of downtime while enquiries bounced or went to a competitor. The technical fix took under an hour. The week of lost enquiries was the expensive part.

The ghost admin: A growing team discovered, entirely by accident during an unrelated update, that an ex-employee who'd left over a year earlier still had full admin access to their website. Nobody had ever removed the login. Nothing bad had happened yet, but the team spent an uncomfortable afternoon working out what that person could have done in the meantime, and quietly auditing every other account on the site.

How to actually do this (plain English, no jargon)

2FA: log into each account and look in security settings for "two-factor" or "two-step verification," usually linked to an authenticator app or a text code. It stops most account takeovers dead, because a stolen password alone becomes useless.

Your domain: registered through a registrar, often separate from your host. Find your renewal receipt, confirm which email owns that account, and make sure it's business-controlled — never personal or an ex-staff member's.

Backups: most hosts have backups built in, often switched off by default. Turn them on, then actually open one and confirm it's recent, rather than trusting the toggle.

Access review: in your admin panel, remove any user account for someone who no longer works with the business — the moment they leave, not during an annual "spring clean."

💡 This checklist won't make you unhackable — nothing will. It closes off the common, lazy entry points behind most small business hacks, so an opportunistic bot moves on to an easier target instead of you.

Mistakes to avoid

Assuming "the web guy handles backups" without ever confirming it or opening a backup file to check.
Sharing one admin login across the team instead of individual logins you can switch off.
Registering your domain under a personal email instead of one the business controls.
Dismissing update notifications because "it's working fine right now."
Treating security as a launch-day task instead of a quarterly five-minute habit.
Panicking and changing everything at once instead of following a calm first-hour plan.

Frequently asked questions

Do I need an IT company to keep my website secure?

No — most of what protects a small business website is account hygiene: backups, 2FA, and knowing who has access. That said, if your site handles sensitive customer data or high traffic, it's worth a conversation with a developer about whether you need more than the basics.

How often should I run this checklist?

Once properly, then quarterly, plus every time someone leaves the business. It's designed to be fast enough that "quarterly" is realistic, not aspirational.

Will this guarantee my site never gets hacked?

No, and be wary of anyone who claims a checklist can guarantee that. It reduces the most common risks significantly, but a genuinely determined attacker can get through almost any defence. For most small businesses the real threat is an automated bot looking for an easy unlocked door, and this checklist takes you off that list.

What's the single most important item if I only do one thing today?

Confirm your backups actually exist and are recent. A working backup is what turns a disaster into an inconvenience if something slips through everything else.

Keep reading 🤍

Written by

Kate, founder of Chronically Online

I help Gold Coast and Brisbane businesses grow with branding, websites and marketing that actually works.

Work with me ✦