Website Security Checklist for Small Businesses

Most attacks on small business websites are not personal. Automated tools scan the internet for outdated software, weak passwords and forgotten admin pages, and they try every site they find. That is good news, because it means a short list of basic habits stops most of them. This checklist covers what to do, in order of impact, and how often to do it.

1. Keep software up to date

Outdated software is the most common way in. Known vulnerabilities in old plugins, themes and content management systems are published, and automated tools look for them within days.

• Turn on automatic updates for your CMS core and, where you trust them, for plugins and themes.
• Remove plugins and themes you do not use. Deactivated plugins can still be exploited if their files remain.
• Replace plugins that have not been updated by their developer for a long time.
• Use a supported PHP version.

How often: check weekly, or let automatic updates run daily and review them weekly.

2. Have backups you have actually tested

Backups turn a disaster into an inconvenience. A good backup routine has three parts:

• Automatic daily backups of files and databases.
• A copy somewhere else, such as a regular download to your computer or cloud storage, so a problem with your hosting account does not take your backups with it.
• A test restore now and then, so you know the backups work and how long a restore takes.

Make a manual backup before every major change, such as a theme switch, a big plugin update or a migration.

3. Lock down logins

Stolen or guessed passwords are the second most common way in.

• Use a password manager and a unique, long password for every account: hosting, control panel, CMS, email and domain registrar.
• Turn on two-factor authentication (2FA) wherever it is offered, starting with your hosting account, control panel and CMS admin. See enabling 2FA.
• Give each person their own login, with only the access they need. Never share one admin account.
• Remove accounts for people who have left, and for agencies you no longer work with.
• Do not use "admin" as a user name.

4. Protect the domain and email

Whoever controls your domain controls your website and email.

• Turn on 2FA at your domain registrar and enable the registrar lock.
• Keep the registrar contact email on an address you check, so renewal and transfer notices reach you.
• Set up SPF, DKIM and DMARC so others cannot easily send email pretending to be you.

5. Use HTTPS everywhere

Every page should load over HTTPS, with HTTP redirected to it. If you use Cloudflare, use Full (strict) mode so the connection to your server is encrypted and verified too. Free certificates make this a zero-cost step.

6. Put a firewall in front of the site

A web application firewall (WAF) filters requests before they reach your site. It blocks known attack patterns, aggressive bots and floods of traffic. Running your site behind a service such as Cloudflare gives you a layer of this protection and keeps your server's address less exposed.

On top of that, many CMSs offer security plugins that limit login attempts and block suspicious requests. Use one, but do not rely on it alone.

7. Scan for malware

Infections are not always visible. Hidden spam links, redirects that only appear for search engine visitors, and injected scripts can run for months unnoticed. Regular malware scans catch them early. Signs you might already be infected include unexpected new admin users, unfamiliar files, warnings in search results, or customers reporting odd redirects.

8. Reduce what is exposed

• Delete old copies of the site, test installations and backup files from public folders.
• Disable directory listing.
• Use SFTP rather than plain FTP, and remove FTP accounts you do not need.
• Do not store sensitive documents in your website's folders.

9. Watch out for phishing

Attackers often go after people rather than servers. Emails that claim your domain is about to expire, your hosting account is suspended, or a payment has failed are common tricks to get you to enter your password on a fake page.

• Do not log in from links in unexpected emails. Type the address of your hosting or registrar yourself, or use a bookmark.
• Check the sender address and the link's real destination before clicking.
• When in doubt, open a ticket with your host and ask whether the message is genuine.
• Make sure everyone with access to the site knows these rules, not just you.

10. Know what you will do if something happens

Write a short plan, even a single page:

1. Who to call: your host's support, your developer, and who in the business decides.
2. Change passwords for hosting, CMS, email and FTP.
3. Restore from the last clean backup.
4. Update everything and find how the attacker got in.
5. Tell affected customers if personal data was involved, as the law may require.

A simple schedule

• Daily: automatic backups and updates.
• Weekly: review updates and security alerts.
• Monthly: review user accounts, download a backup copy.
• Every few months: test a restore and review this checklist.

Security built into Zebra hosting

Every Zebra hosting plan includes Cloudflare in front of your site, free SSL and the Plesk control panel. Our WordPress hosting adds automatic updates on every plan, and WP Business (from €7.99 a month) adds daily backups, malware scanning and a staging site for testing updates safely. Shared Business and above include daily backups too. Pick a plan, and you are protected from the moment it goes live, about two minutes after payment.