Automated bots constantly probe websites to steal data, plant malware or hijack pages for spam. Small business sites are frequent targets because they often run outdated plugins and weak logins. Work through this checklist to protect your site, your customers and your reputation. Most items take an afternoon, and several are free.
1. Use HTTPS With a Valid TLS Certificate
A TLS certificate (still often called an SSL certificate) encrypts data between your website and your visitors’ browsers, so attackers cannot easily read or change it in transit. Browsers flag pages without HTTPS as “Not secure,” which also costs you trust and enquiries.
- Get a certificate free. Most hosts issue free certificates automatically. cPanel’s AutoSSL, for example, installs domain-validated certificates from Let’s Encrypt by default (cPanel).
- Automate renewal. Certificate lifetimes are getting shorter across the industry, with maximum validity set to fall in stages from 2026 to 2029 under a CA/Browser Forum decision (CA/Browser Forum). Let’s Encrypt also stopped sending expiration reminder emails in 2025 (Let’s Encrypt). Manual renewal is no longer a safe plan.
- Use modern protocols. Make sure your server supports TLS 1.3 and has TLS 1.0 and 1.1 switched off. Those older versions were formally deprecated in 2021 (Ietf rfc 8996).
- Force HTTPS everywhere. Redirect all HTTP traffic to HTTPS, and consider enabling HTTP Strict Transport Security (HSTS) once everything works over HTTPS.
2. Protect Every Login With MFA or Passkeys
Stolen and guessed passwords are one of the easiest ways into a website. Multi-factor authentication (MFA) adds a second check, so a stolen password alone isn’t enough. Turn it on for your CMS admin accounts, hosting control panel, domain registrar and email.
- Prefer phishing-resistant options. Passkeys and hardware security keys can’t be phished the way codes can. A passkey lets people sign in the same way they unlock their phone or computer (FIDO Alliance). The US Cybersecurity and Infrastructure Security Agency (CISA) calls phishing-resistant MFA the standard to aim for, while noting that any MFA is better than none (Cisa).
- Use an authenticator app over SMS where passkeys aren’t available, and store backup codes somewhere safe.
- Use long, unique passwords. Current US guidance from NIST recommends at least 15 characters for passwords used on their own, no forced complexity rules and no routine forced changes (Nist sp 800-63b-4). A password manager makes this practical.
- Limit admin access. Give each person their own account with only the permissions they need, and remove accounts when people leave.
3. Keep Software Updated
Outdated software is one of the most common ways in. On WordPress, plugins are the biggest risk: Patchstack found that 91% of new WordPress vulnerabilities reported in 2025 were in plugins, 9% in themes and only six in WordPress core (Patchstack).
- Update your CMS, plugins, themes and server software promptly, especially security releases.
- Turn on automatic updates for trusted plugins. WordPress has supported per-plugin auto-updates since version 5.5 (WordPress.org).
- Delete plugins and themes you don’t use, and avoid plugins that are no longer maintained.
- If you worry an update could break your site, test it on a staging copy first. Contact us if you want to know what quality assurance (QA) testing to run before you publish updates.
4. Check Your Site Against Common Web Risks
If your site has custom code, forms, logins or an online store, ask your developer to review it against the OWASP Top 10, the most widely used list of critical web application security risks. The 2025 edition puts broken access control first and adds software supply chain failures, which covers risks from third-party libraries, plugins and build tools (Owasp).
For a small business, the practical takeaways are: make sure users can only see what they should, keep security settings locked down, know which third-party code your site depends on, and validate everything visitors submit through forms.
5. Monitor Your Website
Regular monitoring catches problems before they do damage. Scan your site for malware, watch uptime, and review logs for suspicious activity such as repeated failed logins or new admin users you didn’t create. Security services such as SiteLock, security plugins and many managed hosts can automate parts of this work. A web application firewall (WAF), often included with a CDN, can block many automated attacks before they reach your site.
6. Back Up Your Website
Backups are your recovery plan. If an attack, a bad update or a server failure takes your site down, a recent backup lets you restore it quickly instead of rebuilding from scratch.
- Back up your files and database automatically, at least daily for an active store and at least weekly for a simple site.
- Follow the 3-2-1 rule: keep three copies of important data, on two different types of storage, with one copy offsite (Cisa).
- Take a fresh backup before every major update or redesign.
- Test a restore occasionally. A backup you’ve never restored is a hope, not a plan.
Make Security Part of Your Routine
Security isn’t a one-time project. Put these checks on a monthly calendar, and review them whenever you add a plugin, a team member or a new feature. Our guide to cloud vs shared hosting explains how your hosting choice affects security too.
Want to spend less time on server upkeep? Apex®, the AI-native digital experience platform (DXP), runs on managed AWS hosting with TLS encryption (AES-256) and includes controls that support GDPR, CCPA and India’s Digital Personal Data Protection (DPDP) Act compliance.
