Website Security Checklist for Small Business: A Plain-Language Guide

It is tempting to think nobody would bother with a plumber in Chilliwack or a farm stand near Sumas Prairie. But most break-ins are not personal. Automated tools sweep huge numbers of websites looking for the same weak spots: software that has not been updated, an easy login password, a plugin with a known flaw. Your site is simply on the list.

What attackers want is a free server to hide on, a place to send spam from, a way to redirect your visitors, or the customer details your forms collect. The damage lands on you: a site marked unsafe, emails that stop reaching inboxes, and customers who find your name beside a warning. A little routine work prevents most of it.

None of these jobs needs a technical background, though a few are easier with help from whoever built or hosts your site. Work through them in order and tick them off. Time spent now is far smaller than the time spent recovering a site later, and most of the list takes an afternoon.

If your site runs on WordPress, updates matter most. Fixes for software flaws are often published openly, and attackers then hunt for sites that have not applied them. A campground or summer rental near Cultus Lake may leave its site alone all winter, which is exactly when to log in and run the updates.

• Update your website platform, themes and plugins, and delete the ones you do not use
• Give every login its own long password, kept in a password manager
• Turn on two-step sign-in for your website admin, hosting, domain and email
• Remove logins for former staff, past freelancers and anyone who no longer needs access
• Confirm the site loads with the padlock and that the certificate renews by itself
• Add spam protection to forms and limit repeated login attempts
• Check that your domain and hosting accounts are in your name, with auto-renew on a card that works

Every other step lowers your risk. A backup removes it. A good backup is recent, stored somewhere other than your website’s own server, and kept in several versions, so that an infection you notice a week late can still be rolled back. Ask your host what they back up and for how long, since some keep only a few days and some leave out email.

Then test it. A backup you have never restored is a hope, not a plan. Ask your developer or host to restore a copy to a test address once, and write down how long it takes and who does it. When the bad day comes, you will know whether you are back online within an hour or within a week.

Warning signs include a site that suddenly slows, pages you never made, visitors sent to strange websites, a browser or Google warning about your site, customers mentioning odd emails from your domain and hosting notices about suspicious activity. Do not wave away a small oddity. Sites are often compromised for weeks before anyone notices.

If customer details may have been exposed, such as names, contact information or booking notes, get advice on your duties to tell people. Canadian and BC privacy rules can apply to a small business that collects personal information, and the privacy commissioners publish plain guidance. Keep notes of what happened and when.

• Tell your host and ask them to scan the account
• Change every password, starting with hosting, website admin and email
• Restore from a backup made before the trouble began
• Update everything before bringing the site back online
• Check Google Search Console for security warnings and request a review once the site is clean

You can do much of this yourself. Bring in help when the site takes bookings or payments, stores customer records or runs on custom software, or when nobody is sure who has access. A professional can check hosting settings, scan for hidden malware, tighten file permissions and set up monitoring that warns you early. That is the work our cybersecurity services cover: audits, hardening and monitoring.

Ask any provider plain questions. What exactly will you check? Who gets access, and how is it removed afterwards? Where do backups live? What will you tell me, and how fast? Be wary of anyone who promises a site can never be hacked, because nobody can promise that. For a first look, the free marketing audit starts with your website and points to what to do next.

Security as a quarterly habit

Website security is not a one-off project. Put a quarterly reminder in your calendar to log in, apply updates, review who has access and confirm that a backup restores. Ten minutes four times a year beats a panic once. Treat the site like the front door of the shop: you lock it every night without thinking, and the website deserves the same routine.

1. 01Update software and delete unused plugins
2. 02Review who has a login and why
3. 03Restore a backup to a test copy

Questions & answers