Most small-business websites are not compromised by sophisticated targeted attacks — they are compromised by automated bots scanning the entire internet for the same handful of common weaknesses. Fixing these does not require a security team; it requires going through a list once and keeping it that way.
1. HTTPS everywhere, no exceptions
Every page, not just the login and checkout, should be served over HTTPS, with HTTP requests redirected automatically. This is table stakes now — free certificates (Let's Encrypt) removed the last excuse not to.
2. Keep software and plugins current
Your CMS, its plugins/modules, and the underlying language runtime (PHP, Node, etc.) should be on a supported version. The majority of real-world website compromises exploit a known, already-patched vulnerability in software nobody updated.
3. Hash passwords properly, rate-limit login attempts
Passwords should never be stored in plain text or with a weak/fast hash — use bcrypt or a similar modern algorithm. Login forms should lock out or slow down after repeated failed attempts, so an automated script cannot simply guess passwords all day.
4. Validate and escape everything a user submits
Any form input, URL parameter, or uploaded file should be validated on the server (not just in the browser) and safely escaped before it is stored or displayed. This is what stands between your site and SQL injection or cross-site scripting attacks.
5. Use CSRF tokens on every state-changing form
Without a CSRF token, a malicious page elsewhere on the web can trick a logged-in visitor's browser into submitting actions on your site without their knowledge. This is a five-minute fix in most frameworks and is worth confirming is actually in place.
6. Set basic security headers
A Content-Security-Policy, X-Content-Type-Options: nosniff, X-Frame-Options, and Strict-Transport-Security header each close off a specific class of browser-side attack. They take minutes to add and cost nothing.
7. Never expose configuration files or backups publicly
Config files, database dumps, and .git directories should never be reachable over the web. This sounds obvious, but it is one of the single most common findings in real website audits — a backup file left in the web root, or a debug endpoint someone forgot to remove.
8. Take backups, and actually test restoring one
A backup you have never restored is a hope, not a plan. Automate backups, store them somewhere separate from the live server, and test the restore process at least once so you know it actually works when you need it.
9. Limit who has admin access, and to what
Every account with admin access is a potential way in. Give people the minimum access they need, remove accounts for anyone who no longer needs them, and use unique passwords per service — never one password shared across the CMS, hosting panel, and email.
None of this is exotic. It is the boring, unglamorous 20% of security work that prevents the large majority of real-world incidents on small business websites.