Website Security Basics for Small Businesses

Information checked: 21 July 2026.

Small-business website security should begin with a short set of controls that reliably reduce common risks. Expensive tools cannot compensate for shared passwords, abandoned software or backups stored inside the compromised account.

In brief: Strong account security, supported software and tested backups provide more value than a collection of unconfigured tools.

The minimum baseline

• Business-owned domain, hosting and administrator accounts.
• Unique passwords stored in a password manager.
• Two-step verification on email, domain, hosting, CMS and payment accounts.
• Supported software with unnecessary components removed.
• Automatic alerts for security updates and privileged account changes.
• Backups stored separately and tested through restoration.
• A written contact and containment plan.

Common weak points

Typical weakness and better control

Weakness	Why it matters	Better control
Shared admin login	No accountability and difficult offboarding	Individual named accounts
Email-only recovery without MFA	Mailbox compromise unlocks other services	Hardened email and recovery methods
Unused plugin or integration	Adds code and credentials without value	Remove and revoke it
Backup in the same hosting account	One incident may destroy live and backup data	Independent protected copy

A monthly owner review

1. Review users and suppliers.
2. Check pending security updates and vendor notices.
3. Confirm backups completed and inspect a sample.
4. Review security alerts and unexpected changes.
5. Test a critical form, booking or order.
6. Record decisions and unresolved risks.

Acceptance check

The baseline is in place when the business can prove who has access, what is protected by MFA, where the independent backup is and how an incident will be escalated.

A one-hour baseline review

A small owner can improve security quickly by reviewing account ownership, enabling MFA, removing unused users and checking whether supported software and independent backups exist. Record gaps instead of installing several overlapping plugins during the same session.

Records to keep

• List of accounts protected by MFA.
• Removed or downgraded users.
• Unsupported components requiring action.
• Independent backup location and latest restore date.

Owner test: Use a clean browser to confirm that old staff credentials no longer work and that recovery belongs to the business.

Sources and date checked

This practical guidance was checked against the following primary sources. Date checked: 21 July 2026.

• NCSC: Small organisations guide to cyber security
• NCSC: Setting up 2-Step Verification
• NCSC: Backing up your data