If you run a small business website, you don't need to become a security expert — but you do need to make sure a handful of standard protections are switched on. This checklist covers the ones that matter most, why they matter, and how to check each.
Why small websites get attacked
A common myth is that attackers hand-pick their targets. In reality, the vast majority of website compromises are opportunistic: automated tools crawl the web looking for known weaknesses — an outdated plugin, a missing header, a default password — and exploit whatever they find. Your site doesn't need to be valuable or well-known to be worth attacking. It just needs a gap. That's good news, because it means a short list of standard fixes closes most of the risk.
The checklist
1. Serve everything over HTTPS
Every page — not just the checkout — should load over HTTPS with a valid TLS certificate, and plain HTTP requests should redirect to HTTPS. Without this, data between your visitors and your site can be read or altered on untrusted networks. Most hosts and platforms offer free certificates (via Let's Encrypt) that renew automatically.
2. Enforce HTTPS with HSTS
A redirect alone can still be bypassed on a visitor's very first request. The Strict-Transport-Security (HSTS) header tells browsers to only ever connect to your site securely. Start with a modest max-age, confirm nothing breaks, then increase it.
3. Add the core security headers
A few response headers dramatically reduce common attacks:
- Content-Security-Policy — controls which scripts can run, the main defence against injected code. See our CSP guide.
- X-Content-Type-Options: nosniff — stops browsers guessing file types.
- Referrer-Policy — prevents leaking private URLs to other sites (e.g.
strict-origin-when-cross-origin). - X-Frame-Options / frame-ancestors — stops your pages being embedded in a malicious frame (clickjacking).
- Permissions-Policy — switches off browser features (camera, geolocation) you don't use.
4. Verify third-party scripts (SRI)
If you load scripts from other companies (analytics, fonts, widgets), add Subresource Integrity hashes so the browser refuses a tampered version. A compromised third-party script is one of the most common ways otherwise-secure sites leak customer data.
5. Keep everything updated
Outdated CMS cores, themes, plugins and libraries are the number-one route in. Turn on automatic updates where you can, remove anything you're not using, and stick to actively maintained plugins.
6. Lock down admin access
Use unique, strong passwords, enable two-factor authentication on every admin account, limit failed login attempts, and remove old accounts for people who've left. Never share a single admin login.
7. Take backups you've actually tested
Automated, off-site backups let you recover quickly from a compromise or mistake. Crucially, test a restore occasionally — an untested backup isn't a backup.
8. Secure your cookies
Session and login cookies should carry the Secure, HttpOnly and an appropriate SameSite attribute so they can't be stolen over insecure connections or misused across sites.
9. Handle personal data properly
Security and privacy overlap. If you collect names, emails or payment details, you have legal duties around how that data is stored, shared and consented to. Our GDPR & privacy basics guide covers the essentials.
How to check where you stand
You can inspect many of these yourself using your browser's developer tools and free header-checking tools. But the results are only useful if you know how to read them and which gaps actually matter for your business. That interpretation — turning a raw list of missing headers into a prioritised, plain-English action plan — is exactly what a security audit provides.
People also ask
How do I check if my website is secure?
Confirm your site loads over HTTPS with a valid certificate, sends the core security headers, runs up-to-date software, and protects admin logins with strong passwords and two-factor authentication. A security audit checks all of this and gives you a single 0–100 score.
How often should I audit my website security?
At least once a year, and again after any major change — a redesign, a new plugin or integration, or a migration. Busier and e-commerce sites benefit from checking more often.
Can a small business website really be hacked?
Yes. Most attacks are automated bots scanning for common weaknesses, so being small is no protection — one unpatched plugin or missing header can be enough.
How much does a website security audit cost?
It ranges from free self-checks to multi-thousand-dollar enterprise penetration tests. A focused small-business audit like Sleak Check Audit is a one-time $300 with a plain-English report in 24–48 hours.
Don't want to work through this alone?
We'll check every item on this list and send you a prioritised, plain-English report in 24–48 hours.
Get my security audit · $300