Web Security Essentials for a Small Business

The most common reaction we hear from small business owners is that nobody would bother attacking them. It is a reasonable thought and it misunderstands how this works. Almost nothing is targeted. Bots crawl the entire internet looking for known weaknesses, and they do not check the size of your company first.

Here is the short list of what actually matters, in the order it matters.

Keep things updated

This is the single largest cause of small business websites being compromised, and it is not close. A vulnerability is disclosed, a patch is released, and within days automated tools are scanning for sites that have not applied it. The window between disclosure and mass exploitation is often measured in hours.

If your site runs a CMS with plugins, this is an ongoing job, not a one-off. Somebody has to apply updates, and somebody has to check the site still works afterwards. If nobody is doing that, you do not have a maintained website — you have a countdown.

It is worth saying that this is the strongest practical argument for a smaller technology footprint. Every plugin is another supplier whose security practices you have inherited. A site with four plugins has a much smaller attack surface than one with thirty, and the thirty-plugin site is not usually thirty plugins' worth of better.

Get the basics right once

HTTPS everywhere. Free certificates have been standard for a decade. Redirect all HTTP traffic, and add HSTS so browsers refuse to try the insecure version at all.

Real passwords and two-factor authentication on every admin account, the hosting panel, the domain registrar and the email account attached to them. The domain registrar and email matter more than people think: whoever controls your email can reset everything else.

Least privilege. The person who writes blog posts does not need an administrator account. Most compromises escalate through an over-privileged account that belonged to someone who left two years ago. Audit the user list; you will find people.

Backups you have actually restored. An untested backup is a belief, not a plan. Automated, off-site, and restored to a staging environment at least once so you know it works and how long it takes.

Security headers

A handful of HTTP headers cost nothing and close whole categories of attack. In rough order of value:

• Content-Security-Policy — controls which scripts may run. The most powerful of the set and the fiddliest to get right, but it turns a script injection from a disaster into a blocked request.
• Strict-Transport-Security — enforces HTTPS.
• X-Content-Type-Options: nosniff — stops the browser guessing file types.
• Referrer-Policy — stops leaking full URLs to third parties.
• X-Frame-Options or a CSP frame-ancestors directive — stops your site being framed by someone else's.

You can check yours in seconds with any of the free header scanners. Most small business sites score badly and can be fixed in an afternoon.

The application itself

Four things that cause most real breaches in custom code:

Validate input on the server. Client-side validation is for user experience. Anything that reaches the server must be checked again there, because an attacker is not using your form.

Use parameterised database queries. Never build SQL by joining strings. This is a solved problem, and every modern framework and ORM does it for you unless you go out of your way.

Escape output. Anything a user typed that gets shown back must be escaped, or you have cross-site scripting. React and similar frameworks do this by default, which is why the dangerous escape hatches are named to sound dangerous.

Rate-limit anything that costs something. Login attempts, contact forms, password resets, API endpoints. Without a limit, your contact form is a free spam relay and your login is a free brute-force target.

Handle personal data as a liability

The safest data is data you do not have. Every field you collect is something you must secure, justify and eventually delete. Reducing what you store reduces the damage of a breach and, in the EU, reduces what you would have to report.

On that: in the Netherlands a reportable breach goes to the Autoriteit Persoonsgegevens without undue delay, generally within 72 hours. Decide today who makes that call, because 72 hours is not long to also be discovering who to ask.

What to do this week

A realistic list for a small company:

1. Check every admin account has two-factor authentication. Start with the domain registrar.
2. Delete accounts belonging to people who no longer work with you.
3. Run a free header scan and fix whatever is missing.
4. Confirm updates are actually being applied by someone, and if not, arrange it.
5. Restore your backup to a test environment. If you cannot, you do not have backups.
6. Count the plugins and integrations. Remove what you do not use.

Being realistic

You are not going to build a fortress and you do not need one. Nearly all attacks on small business sites are opportunistic and automated, and they move on when the easy way in is closed. Patched software, two-factor authentication, sensible headers, real backups and a small attack surface will put you past almost all of it.

The thing that gets companies hurt is not sophistication. It is a plugin that has not been updated since 2023 and an administrator account belonging to a former employee.