Website Security Basics for Small Businesses

By Next Level Web Solutions · · 7 min read · Compliance and trust

Website security basics for a small business come down to six habits: use HTTPS, keep software updated, protect logins with strong passwords and two step sign in, keep backups you have actually tested, block form spam, and know in advance what you will do if the site is compromised. None of this needs a security team, and doing these things well closes off many of the most common routes attackers use.

This guide is for South African small business owners who want a practical routine. It is general information, not legal advice or a substitute for a security audit.

Website security basics: why small sites get attacked

A common belief is that attackers only go after big brands. In reality most attacks are automated. Bots scan the internet for known weaknesses, such as an outdated plugin, a weak admin password or an exposed login page, and they do not care whether the site belongs to a bank or a hair salon.

Compromised small sites are useful to criminals in several ways:

  • Hosting spam pages or phishing pages that borrow your domain's reputation.
  • Sending spam email through your server.
  • Redirecting visitors to scam or advertising sites.
  • Stealing form submissions and customer details.
  • Mining cryptocurrency or joining a botnet using your server resources.

The damage to you is lost trust, a warning label in search results, possible blacklisting of your domain, and a scramble to clean up. If personal information is involved, there can also be obligations under the Protection of Personal Information Act (POPIA), which our POPIA website compliance checklist explains.

HTTPS and certificates

Secure web connection (HTTPS) encrypts the connection between a visitor's browser and your server, so form data and logins cannot be read or altered in transit. Browsers mark sites without it as "not secure", which puts people off exactly when they are about to fill in your contact form.

Practical steps:

  1. Make sure your site has a valid Secure Sockets Layer (SSL)/TLS certificate. Many hosts provide free certificates that renew automatically.
  2. Redirect all HTTP addresses to HTTPS so there is only one version of each page.
  3. Check for mixed content, where a secure page loads an image or script over plain HTTP, which can trigger browser warnings.
  4. Confirm the certificate renews. An expired certificate shows visitors a full-page warning, so put the expiry date in your calendar if renewal is not automatic.
  5. Consider HTTP Strict Transport Security (HSTS) once everything works over HTTPS, ideally with help from your developer.

HTTPS protects data in transit. It does not mean the site itself is free of vulnerabilities, so keep going through the rest of the list.

Updates and plugin hygiene

Outdated software is the most common way small sites are breached. If you use WordPress or another content management system, themes, plugins and the core software all need updating.

  • Turn on automatic security updates where your platform offers them, or schedule a regular update session, for example weekly or monthly.
  • Delete plugins and themes you do not use. Deactivated is not the same as removed.
  • Choose plugins that are actively maintained, widely used and updated recently.
  • Avoid pirated or "nulled" premium plugins and themes, which often contain hidden malware.
  • Keep your server software, such as PHP, on supported versions.
  • Test updates on a staging copy for business-critical sites, especially online shops.

Static sites that are built and deployed as plain files have a much smaller attack surface than database-driven ones, which is one reason we often recommend them for brochure sites. You can read more about how this fits your hosting choice in our guide to local and international web hosting.

Strong logins and two step sign in

Weak and reused passwords are the other main entry point. Attackers try lists of leaked passwords against logins constantly.

  1. Use a unique, long password for every account: your site admin, hosting, domain registrar and business email. A password manager makes this realistic.
  2. Turn on two step sign in (two factor authentication) wherever it is offered, especially for hosting, domain, email and admin accounts.
  3. Do not share one login among several people. Give each person their own account with the minimum permissions they need.
  4. Rename or remove default usernames like "admin".
  5. Limit login attempts, and consider hiding or restricting the admin login page where your platform supports it.
  6. Remove accounts promptly when staff or contractors leave.

Your domain registrar and email accounts deserve extra care. If someone takes over your domain, they can take over your website and your email. If you would like help setting up business email properly, see our services.

Backups you have tested

A backup that has never been restored is a hope, not a plan. Good backups let you recover from hacking, a failed update, accidental deletion or a hosting problem.

  • Back up both files and the database, if your site uses one.
  • Store copies off the server. If the backup lives only on the hacked server, it can be destroyed or infected with it.
  • Match frequency to how often things change. A brochure site that changes monthly may need a backup after each change. A shop taking orders needs backups daily or even more often.
  • Keep several versions, because malware is sometimes discovered days after it arrives.
  • Test a restore at least occasionally, on a staging copy, and write down the steps and how long it takes.

Form spam and bot protection

Contact forms attract spam, and some of it is malicious. Reduce it with layered, user-friendly measures:

  • A hidden honeypot field that humans never fill in but bots do.
  • Invisible or low-friction challenge tools rather than hard-to-read puzzles, which also frustrate people using assistive technology.
  • Server-side validation, because checks done only in the browser are easy to bypass.
  • Rate limits on submissions from the same address.
  • Careful handling of email headers so your form cannot be abused to send spam.

Make sure the form tells people what happens to their details. Our privacy policy guide covers how to describe that.

What to do if you are hacked

Signs include unexpected pages or redirects, a browser or search engine warning, a sudden flood of spam email from your domain, unknown admin users, or your host suspending the account. If this happens:

  1. Stay calm and do not delete everything. Evidence helps work out what happened.
  2. Contact your hosting provider and your web developer straight away.
  3. Take the site offline or into maintenance mode if it is serving harmful content.
  4. Change every password for the site, hosting, database, email and registrar, and revoke unknown users and keys.
  5. Restore from a clean backup made before the compromise, then update everything before bringing it back.
  6. Find the cause (outdated plugin, stolen password) and close it, or it will happen again.
  7. Check whether personal information may have been exposed. If so, you may have notification duties to the Information Regulator and affected people under POPIA, so take professional advice quickly.
  8. Request a review in Google Search Console if the site was flagged.

If you want help with hardening, hosting or recovery, contact us. This article is general information, not legal advice or a security guarantee.

Frequently asked questions

Do I need HTTPS?

Yes. Browsers flag sites without it as not secure, and it protects form submissions and logins from being read in transit. Most hosts offer free certificates, so there is rarely a good reason to go without.

How often should I back up?

Match it to how often your content changes. A rarely changing brochure site may need a backup after each update, while a shop or booking site needs daily or more frequent backups. Keep copies off the server and test a restore from time to time.

Want this done for your business?

Book a free call →