What website security for small business means day to day
Website security for small business is a short routine that keeps the public site available and customer details private. Update the software, give each person a unique login, serve every page over HTTPS, limit admin access, and keep a backup you have restored once. Most trouble starts when one of those items slips. A shared password, an abandoned plugin, or a backup nobody has opened will cause more harm than a rare surprise. Put a name next to the routine so it still happens in a busy month.
Start by writing down what the site is made of. Note the content system, the theme, the plugins or extensions, the host, the domain registrar, and the email provider. If a form sends messages to a personal inbox, that inbox is part of the system too. You cannot protect a piece you have not listed. The list does not need to be technical. It needs to be complete enough that a colleague could find the login page and the backup without calling you on a weekend.
Keep software updates boring
Schedule updates on a day when someone can watch the site afterward. Apply the content system, the theme, and the plugins, then click the home page, a contact form, and the checkout or booking path. If an update breaks a layout, you want to see it before a customer does. Remove plugins you no longer use. Every extra extension is another item to patch and another door into the admin area that you do not need. A smaller site is easier to keep current, and it is easier to explain to the next person who helps you.
Turn on automatic updates only for items you trust and can roll back. For everything else, a monthly review is enough if the site is simple, and a weekly review is wiser if you take payments or store enquiries. Read the notes when a plugin changes how forms or users work. Keep a spare admin account that is not used for daily editing, so a failed login on the main account does not leave you locked out. Write the host support contact on the same page as the routine.
Unique logins and who can change what
Each person who edits the site needs a personal login. Shared passwords make it impossible to know who changed a page, and they linger after someone leaves the company. When a colleague moves on, you should be able to remove one account and be done. Admin rights should be rare. Writers can have editor access. The person who installs plugins can have admin access. Least privilege means the account can do the job and nothing extra, which limits the damage from a lost laptop or a guessed password.
Use a long unique password for every account, stored in a password manager the business controls. Turn on a second sign-in step wherever the host, the content system, and the email provider offer it. Do not send passwords in chat messages or leave them in a shared document. Review the user list every quarter and delete accounts that have not signed in. Check the registrar and the host as well as the content system. A strong website password does little if the domain account still uses a password from years ago.
HTTPS and the records you keep
HTTPS should be on for the whole site, not only the contact page. Visitors look for the lock icon, and modern browsers warn when it is missing. Ask the host to renew the certificate automatically, then visit the site on a phone once a month to confirm the lock is still there. Forms should collect only what you need to reply. A name, an email, and the question are enough for most service enquiries. Extra fields create extra records you must store and protect.
Let a proper payment provider handle card numbers. Do not store them in the content system or in an email folder. If a form emails every submission to a personal inbox, treat that inbox with the same care as the website: a unique login, a second sign-in step, and a rule for who can read it. Delete old exports from laptops when the enquiry has been handled. Write down how long you keep messages, and follow that limit. Smaller piles of data are easier to look after than a folder nobody has sorted since last year.
Backups and a site that looks wrong
Take backups of the files and the database on a schedule the host or a plugin can run without you remembering. Store a copy away from the live server, because a backup on the same machine is lost if that machine fails. Once a quarter, restore a copy to a test address and confirm the home page and a form still work. A backup you have never restored is only a hope. Note how long the restore took and who knows the steps. That note is the plan you will want on a bad morning.
If the site looks wrong, pause and do not follow instructions inside a popup, an unexpected email, or a page you do not recognise. Take the public site offline with the host if customers could be misled, and tell the host what changed. Sign in from a computer you trust, using the password manager, and change the admin, host, and email passwords. Restore the last clean backup if the pages or users look unfamiliar. Then tell affected customers in plain language if their messages or accounts may have been exposed. Vyon Media reviews access, hosting, and backups so this routine matches the site you already run.
