Website Security Best Practice - 12 Ways Small Business Can Protect From Cyber-Threats

Having a website as part of your business can help attract new customers, generate new leads, help with enquiries and build trust. However, websites can be targeted and attacked by cyber-criminals wanting to gain access to sensitive data, install malware, cause disruption or gain unauthorised access to your system.

Small businesses might think that large corporations are more likely to be targeted however any business can be vulnerable to cyber-attacks. If your website has out of date software, weak passwords or poor hosting this can leave you open to cyber-attacks.

Good news! You don’t need to spend much money to improve your website security. By implementing some basic security measures you can help reduce the risks and keep your customer data safe.

Here are 12 best practice tips for website security:

1. Use HTTPS & SSL/TLS Certificate

HTTPS secures the information being sent between your website and the user’s browser. This is important if your website requires any personal information, customer data, logins or payment information.

Using a valid SSL/TLS certificate will also help protect your data.
Things to do:

• Install a valid SSL/TLS certificate
• Ensure your website is using HTTPS.
• Set up redirects to HTTPS.
• Check for any mixed content issues or insecure content.
• Ensure your certificate doesn’t expire.

Whilst very important, this alone won’t fully protect your website.

2. Out of Date Software

One of the most common causes of website vulnerabilities is having out of date software. Cyber criminals look for known vulnerabilities in your content management system, plugins, themes, frameworks and server.
Regardless of whether you have a WordPress, CMS or bespoke site, your website should be regularly maintained.
Things to do:

• Install security updates and patches.
• Update your plugins, themes, libraries and frameworks.
• Remove any unused extensions and apps.
• Replace any unsupported software with supported versions.
• Test any major changes.
• Use a regular maintenance schedule.

3. Multi-Factor Authentication

Having a secure password can be a good start but if someone gets hold of your logins via phishing or data breaches then you need extra measures to ensure you’re protected. Multi-factor authentication provides an extra layer of security to ensure no unauthorised users get into your account.
It’s important to protect your administrator accounts on small businesses as they may have permission to edit content, manage users and access sensitive information.
Things to do:

• Enable multi-factor authentication on your CMS administrator accounts.
• Secure your hosting, domain and cloud accounts.
• Secure your business email accounts used for website administration.
• Use phishing free authentication.
• Check how you can recover your account and remove any old access.

Adding this extra layer can make it much more difficult for attackers to gain control of important accounts.

4. Use Strong Passwords

Using the same password across your website, email, host and other services can create unnecessary risks. If someone gains access to one account they may try to use the same details elsewhere.
Things to do:

• Use long unique passwords.
• Use a reputable password manager.
• Don’t share any administrator passwords.
• Change any default passwords.
• Limit login attempts.
• Where possible each employee should have their own account.

5. Regular Backups

Even with good security measures in place the odd incident can occur. Having a recent backup can help you get your website back up and running if you accidentally delete something, suffer a server issue, ransomware attack or malicious changes.
Only useful if you can actually recover it!

Things to do:

• Backup your website files, database and important settings.
• Automate your backups depending on how often changes are made.
• Store secure copies.
• Limit access.
• Regularly test your backups. If your website has lots of orders or customer enquiries, you may want to increase how often you back up.

6. Secure Host

Having a secure host can help protect your website. A reputable host will provide protection, monitoring, backups and support if there are any issues.
However, different hosts provide different levels of security.
Things to do:

• Check the host has good security and backup policies.
• Check if they regularly update their server software.
• Look for hosts offering firewalls, malware detection and DDoS protection.
• Check how they will inform you of any security issues.
• Understand what security is your responsibility.

Choose a host that fits your website, what it does and your business requirements.

7. Web Application Firewall

A web application firewall helps to filter and monitor your HTTP traffic. Depending on the firewall you use, you can help protect yourself from suspicious requests and certain common attacks.
This can be useful for businesses with public facing websites, online stores and customer portals.
Things to do:

Use a reputable web application firewall or managed security service.

• Ensure you’ve set up any security rules.
• Monitor any blocked requests and security alerts.
• Review your settings after any major changes.
• Ensure you’re using secure coding and updates alongside the firewall.
• A firewall is just a single layer of protection.

8. Limit Permissions & Administrator Access

Not everyone working on your website will need administrator access. Having too many permissions can cause extra damage if your account is compromised or changes are made accidentally.
An example would be giving an content editor permission to publish articles but not give them access to change server settings or create administrator accounts.

Things to do:

• Give users the correct level of permissions.
• Have individual accounts for each team member.
• Remove access to any employees/contractors leaving.
• Regularly check your administrator accounts.
• Don’t use administrator access for everyday tasks. This will limit any unnecessary exposure and help identify any unauthorised changes.

9. Protect Against Malware

Malware can cause issues including compromising your website files, causing redirects, injecting unwanted content or exposing your sensitive information. Having a compromised website can affect your customer confidence and search visibility.
You should look to prevent and detect any malicious activity.

Things to do:

• Use a reputable malware solution.
• Check for any unexpected changes.
• Remove any suspicious or unused plugins/scripts.
• Limit your file permissions.
• Investigate any security alerts from your host and search engines. If malware is detected, investigate why it has occurred, clean up the environment, patch the vulnerability and check any credentials that could be compromised.

10. Validate Forms & Customer Data

Having contact forms, sign up forms, search boxes and checkout can cause security issues if not handled correctly.
If you don’t validate the input correctly this can cause vulnerabilities such as SQL Injection and Cross-site scripting. This can expose your data or cause malicious code to impact your website users.

Things to do:

• Validate and sanitise input on the server.
• Use parameterised queries.
• Encode output based on the context.
• Add the correct amount of spam prevention and rate limiting.
• Only ask for the information you really need from your customers.
• Encrypt sensitive information and limit access. Any forms or applications should be tested by your developers to ensure they don’t have any common vulnerabilities.

11. Train Your Employees

Employees can cause your systems to be compromised by clicking on malicious links, downloading unsafe attachments or sharing their logins.
Training your employees can help prevent this.
Things to do:

• Train your employees to spot phishing emails.
• Teach them how to verify suspicious links and attachments.
• Have a process in place for reporting any suspicious activity.
• Ensure they use multi-factor authentication on relevant business accounts.
• Train them to handle customer information correctly.
• Regularly check their permissions. Having regular short training sessions can help your employees create better habits.

12. Monitor & Test

You should continually monitor your security. As changes are made to your website code, plugins, hosting and business requirements this can cause new vulnerabilities.
Regular monitoring will help spot any issues.
Things to do:

• Check your login history and security alerts.
• Check your website is accessible and not redirecting.
• Use a vulnerability scanner.
• Regularly check your security.
• If your website has a high risk, arrange for professional penetration testing.
• Document your incident response and recovery. If you suspect your website has been compromised, follow your incident response plan.

Ensure the relevant team are involved, contain the incident, keep logs and if needed restore from trusted backups. Fix the vulnerability.
Website Security Checklist For Small Businesses

Final Thoughts

Every small business with an online presence should look to keep their website secure. Having a compromised website can cause disruption, expose your customer data and reduce the trust you have built.

By implementing these 12 best practice tips to improve your website security, you can improve your defences. Start with the basics such as updating your software, multi-factor authentication, strong passwords and trustworthy backups. As your business grows you can improve your monitoring, permissions, applications and incident readiness.

For a more in-depth guide look at website security best practices to help protect from cyber threats.

The most important thing is to be consistent. Check your security regularly and fix any vulnerabilities. Make securing your customer data part of your daily business.