How to Protect Your Website From Hacks (Small Business Guide)

How to Protect Your Website From Hacks (Small Business Guide)

You protect a website from hacks by doing a short list of unglamorous things on a schedule: lock down logins with multi-factor authentication, patch software quickly, keep tested backups, limit who can change what, and watch for changes you did not make. None of it is exotic. Most small business sites get compromised because one of these basics was skipped, then forgotten.

This guide walks through each control in plain language, shows what to check monthly on WordPress, explains how malware gets in, and lays out the steps to take if you are already hacked.

Summitstudio

Keep Your Website Improving Over Time

Summit Studio provides ongoing website optimization for SEO and conversion, helping small businesses adapt their online presence as needs change.

Visit Summit Studio

TL;DR

• Turn on multi-factor authentication for every admin account, then check that it is actually enforced.
• Patch core software, plugins and themes fast, and delete anything you do not use.
• Keep backups off the server and test a restore, because an untested backup is a guess.
• Decide who is responsible for security after launch. Unowned security is the usual root cause.
• If you are hacked, document first, contain second, restore from a known-good copy third.

Table of Contents

• What attackers actually want from a small business site
• Ten controls that stop most attacks
• A monthly WordPress security routine
• How to prevent a malware infection
• If your site is already hacked
• The real gap: nobody owns security after launch
• Our perspective: security is a monthly habit, not a launch feature
• Where Summit Studio fits
• FAQ
• Sources

What attackers actually want from a small business site

A small site is not too small to target. Attacks are largely automated: scripts scan for outdated software and weak logins, and they do not care how big your company is. CISA describes the outcomes of a successful attack as defacement, denial of service, compromise of sensitive data, takeover of the site, or use of your site as a staging point to reach your visitors.

The Canadian Centre for Cyber Security lists the common techniques: SQL injection, cross-site scripting, cross-site request forgery, denial of service, adversary-in-the-middle attacks, malware, credential stuffing and brute force. You do not need to master each one. You need to see that they fall into two groups:

• Attacks on your logins. Credential stuffing and brute force reuse leaked or guessable passwords. The defense is strong unique passwords and MFA.
• Attacks on your code. Injection, scripting and request forgery exploit software flaws or sloppy handling of visitor input. The defense is patching and input validation.

For a business site, the cost is rarely the cleanup bill alone. A hacked site can lose search visibility, send visitors to malicious pages and break the trust that turns traffic into leads.

Ten controls that stop most attacks

1. Enforce multi-factor authentication

CISA’s small business guidance says to technically enforce MFA, especially for system administrators, and to regularly check for accounts that are not compliant. The word “enforce” matters. A setting that is available but optional will be skipped by the one person whose account matters most. NIST adds that phishing-resistant MFA is preferable where it is available.

Apply MFA to your CMS admin, hosting account, domain registrar, email and anywhere your site’s analytics or tag manager lives. Losing the registrar login is worse than losing the site.

2. Use unique passwords and a password manager

NIST recommends strong, unique passwords stored in a password manager. Credential stuffing works only because people reuse passwords. If your site login matches a password leaked from some other service, MFA is the only thing standing between you and a takeover.

3. Patch quickly, and prioritize

CISA calls patching a cost-effective defense. It recommends enabling automatic updates where possible and prioritizing vulnerabilities in its Known Exploited Vulnerabilities (KEV) catalog, which lists flaws that attackers are already using. You do not have to read the catalog daily, but whoever maintains your site should know it exists and treat anything listed there as urgent.

4. Back up, then test the restore

CISA says to run regular backups, test both partial and full restores, and document a restoration plan. The WordPress hardening guide adds two details worth copying. Back up the complete installation and the database. Keep timed snapshots in a trusted location, so that if you discover a compromise weeks late, an older clean version still exists.

A backup stored on the same server as the site goes down with the site. Keep at least one copy elsewhere.

5. Choose hosting that does its share

The FTC advises choosing hosting that provides current TLS, can keep software updated, and supports domain-email authentication with SPF, DKIM and DMARC. That last item protects your brand from spoofed email, a common companion to website attacks.

6. Use HTTPS everywhere, with HSTS

MDN recommends HTTPS and HSTS, which tells browsers never to load your site over an insecure connection. HTTPS encrypts traffic between visitor and server. It does not make your site secure on its own, so treat it as table stakes rather than the finish line.

7. Give people only the access they need

The agency that built your site three years ago, the freelancer who wrote blog posts, the employee who left: each is a potential open door. Use named accounts, give each person the lowest role that lets them do their job, and remove access the day a relationship ends. WordPress’s hardening guidance supports limiting unnecessary privileges for files and the database as well as for users.

8. Minimize what you store

MDN recommends minimizing stored sensitive data. If you never collect card numbers, copies of IDs or unneeded personal details, a breach cannot expose them. Let a payment processor handle payments, and delete form submissions you no longer need.

9. Scan for vulnerabilities and watch for changes

MDN lists vulnerability scanning as a core practice, and WordPress guidance recommends monitoring logs and file changes. The goal is to notice a modified file or a new admin user within hours, not months.

10. Train whoever has a login

NIST includes employee training on phishing and ransomware in its basics. A convincing email that captures an editor’s password beats most technical defenses.

A monthly WordPress security routine

WordPress powers a huge number of small business sites, and the same few problems recur: outdated plugins, abandoned plugins, weak admin accounts. If you run it, the official hardening guide points to a routine you can put on a calendar:

1. 01Update core, plugins and themes. Do it weekly if you can, monthly at the outside, and immediately for known exploited flaws.
2. 02Delete what you do not use. A deactivated plugin still sits on the server. Remove it entirely.
3. 03Review users. Remove stale accounts, confirm each admin has two-step authentication.
4. 04Check permissions. Files and database accounts should have no more privileges than they need.
5. 05Confirm a fresh backup exists and that it covers both files and database.
6. 06Review logs and recent file changes. Look for edits you cannot explain.

Two cautions. First, update on a staging copy if the site takes orders or bookings, so a bad update does not break your revenue path. Second, if this list feels like a second job, that is a signal about ownership, covered below.

How to prevent a malware infection

Malware usually arrives by one of three routes: a stolen login, an outdated component, or an upload or form that accepts something it should not.

MDN’s central rule is never to trust data that comes from the browser. That includes URL parameters, requests, headers, cookies and uploaded files. Many exploits succeed because an application implicitly trusts what visitors send. In practice:

• Validate and sanitize all input. Forms, search boxes and comment fields should accept only the expected type and length of data.
• Restrict file uploads. Allow only the file types you need, rename uploaded files, and never let uploads execute as code.
• Keep software current. Most infections exploit a known, already-fixed flaw.
• Keep antivirus current on the computers that administer the site. NIST includes updated antivirus in its basics, and an infected laptop can leak the login you worked to protect.

If you use forms built by a developer or a platform, ask directly how input is validated. A good team can answer in a sentence.

If your site is already hacked

Stay calm and work in order. The WordPress hacked-site FAQ lays out a sequence that applies well beyond WordPress:

1. 01Document. Write down what you saw, when it started, what changed recently and where the site is hosted. This helps whoever investigates.
2. 02Scan. Scan the site and the devices of everyone who administers it.
3. 03Call your host. They can often see server logs and may be able to isolate the problem.
4. 04Preserve a backup of the compromised state for investigation, even though you will not restore from it.
5. 05Reset every credential. That means site admins, hosting, database, FTP or SFTP, and on WordPress the secret keys.
6. 06Clean or restore from a known-good backup. This is where the timed snapshots mentioned earlier pay off.
7. 07Check the aftermath. Look at whether search engines or security services have flagged your domain, and request a review once it is clean.

If customer data may have been exposed, talk to a lawyer about breach notification duties in the states where your customers live. Those rules vary by state, and a general article cannot tell you what yours require.

Once the site is clean, ask the harder question: why did it happen? Treating the symptom without finding the cause is how the same site gets hacked twice. Teams that run IT operations draw a line between incident versus problem management: fix the outage now, then find and remove the underlying cause. The same discipline applies to a small business website.

The real gap: nobody owns security after launch

The FTC says small businesses should clarify who will manage website security after launch and understand how the site’s software will be kept up to date. That sentence describes the most common failure we see in the market: a site gets built, handed over, and nobody is named to patch it.

The FCC’s Cybersecurity Planning Guide, hosted by CISA, describes web-server security as an ongoing process of configuration, protection, monitoring and vigilance. NIST frames cybersecurity as continuous business-risk management, not a one-time setup task. CISA goes a step further: controls should be verified, not assumed. Measure MFA enrollment, patch status and whether a backup can really be restored.

Three questions will tell you where you stand:

• Who, by name, is responsible for updates on this site?
• When was the last time someone restored a backup to prove it works?
• Can that person tell you how many admin accounts lack MFA?

If any answer is “I don’t know”, that is your first fix. Our own take on the starting point is in the website security basics every small business should fix first.

Our perspective: security is a monthly habit, not a launch feature

We build and run websites for small businesses as a monthly membership, and the pattern we see is consistent. Sites rarely get hacked because of a clever, one-off attack. They get hacked because a plugin sat unpatched for months, an old contractor account stayed open, or a backup was never tested.

That is why we do not think of security as a feature you buy once. A traditional project ends at launch, and the checklist in this article starts at launch. The controls above are cheap individually. What is expensive is the attention: someone has to do them every month, verify they happened, and report what changed.

Our view is that this work belongs with a single accountable team that also looks after your search performance and conversion, because a site that is down, flagged or defaced loses the traffic and leads those efforts build. AI helps us watch more, faster, and human strategists decide what matters. If you are weighing whether to do this yourself, be honest about the calendar time it takes, then decide who owns it.

— John

Where Summit Studio fits

If you would rather not carry this routine yourself, our Summit Security add-on provides proactive website security monitoring for $149 per month, and you can see how it sits alongside our other add-ons on the solutions page. Our growth memberships, Base Camp at $699 per month, Ascent at $1,299 per month and Summit at $2,499 per month, are described on the pricing page. Pick the level that matches how much content and testing you want, then add monitoring if security is your first concern.

FAQ

What is the single most effective step to protect a website from hacks?

Enforce multi-factor authentication on every admin account, starting with your CMS, hosting and domain registrar. Stolen and reused passwords are among the most common ways in, and MFA blocks most of them. Then check periodically that nobody has been left out, as CISA advises.

How often should I update my website’s software?

Turn on automatic updates where they are safe, and review everything else at least monthly. Anything listed in CISA’s Known Exploited Vulnerabilities catalog should be patched as soon as possible. If your site handles orders or bookings, test updates on a staging copy first.

Is an SSL certificate enough to keep my site safe?

No. HTTPS encrypts the connection between your visitors and your server, and MDN recommends it along with HSTS. It does nothing about weak passwords, outdated plugins or unvalidated form input, which is where most compromises start.

How do I know if my website has been hacked?

Warning signs include pages or admin users you did not create, files that changed unexpectedly, redirects to other sites, browser or search warnings about your domain, and sudden drops in traffic. File-change monitoring and log review catch these sooner than waiting for a customer to tell you. If you suspect a problem, follow the documentation, scan, host-contact and credential-reset steps above.

Sources

• Website Security, CISA
• Security considerations when developing and managing your website, Canadian Centre for Cyber Security
• Cyber Guidance for Small Businesses, CISA
• Cybersecurity for Small Business, Federal Trade Commission
• Cybersecurity Basics, NIST
• Website security, MDN Web Docs
• Hardening WordPress, WordPress Developer Resources
• FAQ My site was hacked, WordPress documentation
• Cyber Security Planning Guide, FCC via CISA

Recommended

• The website security basics every small business should fix first
• What HIPAA actually requires of your website forms
• Fix 301 Redirects First: SSL, HTTPS Migration and SEO for Site Owners
• Summit Security | Proactive Website Security Monitoring