Website security for small businesses

Your website is often the first place a customer meets your business. Keeping it in good shape protects their information, keeps browser warnings away, and makes your site a less attractive target for automated attacks.

Most of the work is changing settings rather than writing code, and the guides below take you through each setting step by step.

What does website security mean for a small business?

For a small business, website security is mostly about four things. Your site should load over an encrypted connection (HTTPS). Its SSL certificate should be valid and renewing on time. Your server should send a few browser safety instructions called security headers. And the software behind your site, plus the logins that control it, should be kept up to date and well protected.

Security headers are the least familiar of these. They're short instructions your server sends with every page. One of them, HSTS, tells browsers to always use HTTPS for your site. Others stop your pages being secretly embedded inside another site, or limit what a malicious script could do if one slipped in. Most can be added in a few minutes at your host or CDN, and the free security headers checker shows which ones you already send.

None of this needs an IT department. Pick one item, fix it, and move to the next.

Why do browsers show a "Not secure" warning?

Browsers show "Not secure" when a page loads without HTTPS, or when the certificate is missing, expired or doesn't match your domain. Visitors often leave when they see it, and contact forms on those pages can be read by anyone on the same network.

Our guide to why your website says Not Secure explains each cause and how to fix it with your host. If your certificate has lapsed, follow what to do when an SSL certificate expires. You can confirm the fix with the free SSL checker.

What should a WordPress site owner do first?

WordPress powers a large share of small business websites, so it gets a lot of attention from automated attack tools. The basics go a long way: keep WordPress, your theme and every plugin updated, remove plugins you don't use, and turn on two-step sign-in (MFA) for every admin account.

Our WordPress security checklist puts these steps in order, with notes on what your host can handle for you.

How can I tell if my website has been hacked?

Common signs include unfamiliar pages or links, redirects to other sites, new admin users you didn't create, or a warning from Google or your host. Sometimes the first sign is customers telling you something looks wrong.

If you notice any of these, read how to tell if your website is hacked. It covers what to check, who to contact, and how to clean up calmly. Our scan also checks whether your domain appears on a public phishing blocklist, which can be an early clue.

Where should I start?

Start by seeing where you stand. The free website security scan checks HTTPS, your certificate, security headers, cookies and more in one pass, then lists plain-English fixes in priority order. You can preview the format in our example report, or see the full list of checks on what we check.