How do you keep a small business website secure?

A small business website is rarely attacked by a person who picked it out. Most attacks are automatic: software scans the internet for old versions, weak passwords and open admin pages. This means basic habits reduce much of the risk. This guide lists those habits and the questions to ask whoever builds or runs your site. It is general information, not a security audit.

Where small sites usually fail

• Out-of-date software. A known flaw stays open until someone updates the framework, library or plugin. Automatic scanners look for exactly these.
• Weak or reused passwords. One password reused on several services opens all of them when one leaks.
• Too many people with too much access. Old staff, old agencies and shared logins stay active for years.
• Admin pages open to everyone. A login page on a well-known address, with no second step, is a target.
• Unvalidated forms. A form that trusts what a visitor types can be used to send spam, inject content or reach data. Input must be checked on the server, not only in the browser.
• Secrets in the wrong place. Keys and passwords in the page code, in a public repository or in an email are visible to others.
• No plan for a breach. Without backups and a named contact, a small incident takes much longer to fix.

Habits that reduce the risk

• Keep software current, and remove plugins and tools you no longer use. See what website maintenance includes.
• Use a password manager and a second step (two-factor sign-in) on the admin, hosting, domain and email accounts. The UK National Cyber Security Centre explains this in its small organisations' guide to cyber security and its tips for staying secure online.
• Give each person their own login and remove it when they leave.
• Serve every page over HTTPS and keep the certificate renewed.
• Validate on the server. Check every field, limit how often a form can be sent and return clear errors.
• Keep secrets out of the code. Store keys in the hosting settings, never in the page. See website hosting.
• Back up, and test the restore.
• Add security headers. Browser headers such as a content security policy limit what a page may load. The MDN web security pages explain them.

Know the common risks by name

The OWASP Top Ten lists the most common web application risks, such as broken access control and injection. You do not need to read it all. You can ask your developer which of them the site was checked against.

Personal data and the law

A site that collects names, e-mail addresses or orders holds personal data. This is general information, not legal advice. Both the UK and France have data protection rules, and a breach can carry a duty to report it. See the ICO guidance on personal data breaches and the CNIL page on notifying a breach. For cookies, see website cookies. For French public advice for small organisations, see Cybermalveillance.gouv.fr. Ask a qualified adviser about your own duties.

Questions to ask whoever builds or runs your site

• How and how often is the software updated, and who does it?
• Do the admin, hosting and domain accounts use a second sign-in step?
• Where are secrets stored, and who can read them?
• How is form input checked, and what limits spam?
• What happens, step by step, if the site is hacked?
• When was the last backup restored?

Sources and further reading

• NCSC: small organisations' guide to cyber security
• NCSC: top tips for staying secure online
• OWASP Top Ten
• MDN: web security
• ICO: personal data breaches
• CNIL: notifying a breach
• Cybermalveillance.gouv.fr

How DMC Kreatif handles it

We keep secrets out of the page code, check form input on the server, and send security headers with every page. We cannot promise that a site will never be attacked, and this guide is not a security audit. Ask us what we check on your project, then ask for a quote. Within 48 h you get a concrete approach, a realistic timeline and a clear quote. Our websites service page shows how a project runs.