Quick answerA small-business website should have valid HTTPS with automatic HTTP-to-HTTPS redirect, security headers (HSTS, CSP, X-Content-Type-Options, X-Frame-Options), up-to-date software and plugins, no exposed files such as .env or .git, daily off-site backups, two-factor authentication on admin and hosting accounts, and SPF, DKIM and DMARC records so no one can send email pretending to be your domain.
Small business sites are attacked constantly by automated bots looking for outdated plugins, leaked configuration files and weak admin passwords. You don't need a security team to block most of it. Work through this list, or run Drofsecurity's free website scan to check many of these items in one go.
Encryption and headers
- HTTPS with a valid certificate on every page, and HTTP redirecting to HTTPS.
- Strict-Transport-Security (HSTS) so browsers always use HTTPS.
- Content-Security-Policy to limit which scripts can run, reducing the damage from injected code.
- X-Content-Type-Options: nosniff and X-Frame-Options (or CSP frame-ancestors) to stop content sniffing and clickjacking.
- Cookies marked Secure, HttpOnly and SameSite.
Software and exposure
- CMS core, themes, plugins and JavaScript libraries kept updated. Old versions with known CVEs are the most common way in.
- No exposed /.git/, /.env, backup .zip or .sql files in the web root.
- Directory listing turned off.
- Remove unused plugins, themes and test pages.
Accounts and backups
- Two-factor authentication on hosting, domain registrar, CMS admin and email accounts.
- Unique admin usernames (not "admin") and strong passwords.
- Automatic daily backups stored off the server, and a tested restore.
Email spoofing protection
- SPF record listing who may send email for your domain.
- DKIM signing enabled in your email provider.
- DMARC record, starting with p=none to monitor and moving to p=quarantine or p=reject.
Next step
Run a free scan on Drofsecurity to get a grade and a prioritised fix list for your site. If you'd rather have it done for you, our Website Security Fix service handles the changes.
Frequently asked questions
How do I check if my website is secure?
Run a passive scan, such as Drofsecurity's free website scanner, which checks TLS, security headers, cookies, outdated JavaScript libraries and email-spoofing records, and gives a grade with fixes.
What security headers should every website have?
At minimum Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options and X-Frame-Options or frame-ancestors, plus a Referrer-Policy.
How often should a small business back up its website?
Daily, automatically, with copies stored off the hosting server, and test a restore at least every few months.