Website Security Basics for Small Business Owners
You don't need to be a tech expert to keep your website reasonably safe. Most attacks on small business sites are automated and go after common, easy-to-fix weak spots. These basics cover a lot of ground.
Keep everything updated
Outdated software is one of the most common ways sites get hacked. Keep these up to date:
- The CMS core (Joomla, WordPress, or other)
- Add-ons, themes, and templates
- The server software (usually your host's job)
Remove add-ons and themes you don't use. Even inactive ones can be a risk.
See How to Update Joomla Safely or How to Update WordPress Safely.
Use strong passwords and two-factor authentication
- Use a long, unique password for every account. A password manager makes this easy.
- Turn on two-factor authentication (2FA) for your site admin, hosting, domain registrar, and email. Joomla includes multi-factor authentication. WordPress usually needs a security plugin for it.
- Never share logins. Give each person their own account.
Limit who has access
- Give people only the access they need. Not everyone needs to be an administrator.
- Remove accounts for former staff and contractors right away.
- Review your user list a few times a year.
See How to Add Users and Set Permissions in Joomla or How to Add Users and Set Roles in WordPress.
Keep backups
Regular, off-site backups mean a problem doesn't have to be a disaster. See Website Backups: What to Back Up, How Often, and How Restores Work.
Use SSL (https)
Your site should load on https:// everywhere, with no browser warnings. Most hosts include a free certificate.
Choose a good host
A good host keeps server software current, isolates sites from each other, and helps when something goes wrong.
Protect your domain and email
- Know who your domain is registered to, and make sure it's in your business's name.
- Keep the registrar account secure with 2FA.
- Keep email on a dedicated email service, separate from your web hosting, so a website problem can't take your email down with it. See Domain, DNS, and Business Email Basics: Who Owns What.
- Watch for phishing emails pretending to be your host, registrar, or bank.
Clean up old stuff
Old copies of your site, test installs, and unused files left on the server are easy targets. Remove them.
Know what to do if something goes wrong
If your site is hacked, see My Website Was Hacked: What to Do Right Now.
How 3by400 can help
Our boutique hosting takes a proactive approach to security, with tight server and site security, nightly backups, 24/7 outage monitoring, and ongoing core CMS updates. It's available to our clients, including sites moved over from another host. We also clean up hacked sites on demand at hourly rates. Start a project or move your site.
Start a project
Ready to talk about your website? Start a project or reach us at 678-379-9321 or