Websites & online business
The security checklist every small business website needs
Small business websites are hacked all the time, not because anyone is targeting your business, but because automated tools scan for out-of-date software and weak logins. A hacked site can redirect visitors to scams, get blacklisted by Google or leak enquiry data. This checklist covers what matters most.
The short version
The top five
- Every admin uses their own login with two-step verification.
- Software, themes and plugins update automatically or monthly.
- Backups run daily and are stored separately.
- Your domain and hosting accounts are in the business’s name and secured.
Logins and access
- Every person who edits the site has their own account, not a shared admin login.
- Two-step verification is on for website admins, your hosting account, your domain registrar and your DNS provider.
- Admin access is limited to people who need it. Others get editor roles.
- Old staff, agencies and freelancers have been removed.
- Login pages are protected against repeated guessing, through your host, a security plugin or your website builder.
Updates
- The website platform (such as WordPress) is on a supported version.
- Plugins and themes update automatically, or are checked at least monthly.
- Unused plugins and themes are deleted, not just deactivated.
- Plugins come from reputable sources. No “nulled” or pirated premium plugins, which often contain malware.
The ASD has repeatedly warned about large-scale campaigns exploiting outdated website content management systems and plugins.
Hosting
- Your host supports current PHP or runtime versions and applies server updates.
- HTTPS is on for every page, with a certificate that renews automatically.
- Your hosting control panel (such as cPanel) uses a strong, unique password with MFA.
- File permissions follow your host’s recommendations, and there are no old copies of the site lying around in public folders.
Backups
- Daily backups of files and database, stored separately from the website server.
- At least 30 days of backup history, so you can go back before a hidden problem started.
- You’ve tested restoring a backup at least once.
Forms and data
- Contact and enquiry forms have spam protection, such as Cloudflare Turnstile or reCAPTCHA.
- Form submissions are emailed or stored securely, and old submissions are deleted when no longer needed.
- Your privacy policy describes what the site collects.
- Payment details are handled by a payment provider like Stripe, Square or PayPal, never stored on your site.
Monitoring
- Google Search Console is set up, so Google can warn you about security issues.
- Uptime monitoring alerts you if the site goes down.
- Someone checks the site regularly for content or links you didn’t add.
Website builders handle some of this for you
Platforms like Squarespace, Wix, Shopify and NovaSoft Sites manage hosting and core updates. You’re still responsible for logins, two-step verification, connected apps and your domain.
Your domain
Your domain controls both your website and your email. Make sure it’s registered to your business, auto-renews and is protected by MFA and registrar lock. See protecting your domain name.
Common questions
Is WordPress insecure?
WordPress itself is well maintained. Most problems come from outdated plugins, weak logins and poor hosting. Keep it updated and minimal.
Do I need a security plugin?
It can help with login protection and malware scanning, but it’s not a replacement for updates, backups and MFA.
How do I know if my site has been hacked?
Signs include Google warnings, unexpected redirects, spam pages appearing in search results, or your host suspending the site. See website hacked.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.