Most website security breaches don't target a specific company — they're automated scans hitting thousands of sites, looking for the same handful of common weaknesses: an out-of-date plugin, a missing security header, a weak admin password, a certificate nobody renewed. Small businesses are hit disproportionately hard because they rarely have a dedicated security team watching for these gaps.
The good news is that the highest-impact fixes are also the cheapest and fastest to make. This checklist walks through them in priority order — no assumption that you have an IT department, and no unnecessary jargon.
Why small businesses are a bigger target than they think
Attackers don't need to "want" to hack your specific business — most attacks are automated bots that continuously scan the internet for known vulnerabilities: an unpatched plugin version, a server missing a security header, a login form with no rate limiting. A small business site is exactly as vulnerable to these automated scans as a large enterprise one, and often more so, because it's less likely to have monitoring in place to notice something went wrong.
The cost of a breach isn't just technical — it's customer trust, search rankings (Google actively penalizes or flags compromised sites), and in some cases legal exposure if customer data is involved. Prevention is far cheaper than cleanup.
1. Enforce HTTPS everywhere
If your site still allows HTTP access, or serves any resources over plain HTTP on an otherwise HTTPS page ("mixed content"), that's the first thing to fix. HTTPS encrypts the connection between your visitors and your server, which protects login forms, payment details and any data submitted through your site.
- Install an SSL/TLS certificate — free options like Let's Encrypt provide the same encryption strength as paid certificates for most small business needs.
- Redirect all HTTP traffic to HTTPS automatically at the server level.
- Check for mixed content — images, scripts or stylesheets still loading over HTTP on an HTTPS page.
You can verify your certificate's validity, expiry date and configuration with a free SSL checker in seconds.
2. Add the missing security headers
HTTP security headers are simple server configuration settings that tell browsers how to treat your site defensively — and most sites are missing at least one of them by default.
- Content-Security-Policy (CSP) restricts what scripts and resources are allowed to run on your page, reducing the damage a cross-site scripting attack can do.
- Strict-Transport-Security (HSTS) tells browsers to always use HTTPS for your domain, even if a user types "http://" by habit.
- X-Frame-Options prevents your site from being embedded in a hidden frame on another site (clickjacking protection).
- X-Content-Type-Options: nosniff stops browsers from misinterpreting file types in ways attackers can exploit.
These are typically a few lines of server or CMS configuration — not a redevelopment project. A free security header scan shows you exactly which ones are missing on your site right now.
3. Keep your CMS, plugins and themes updated
If you run WordPress, Shopify, or any platform with plugins/extensions/themes, outdated versions are one of the most common breach vectors — security researchers regularly publish exploits for known vulnerabilities in old plugin versions, and automated bots use these lists constantly.
- Turn on automatic updates for security patches wherever your platform allows it.
- Remove plugins and themes you're no longer using entirely — an inactive plugin can still be exploited if it's still installed.
- Subscribe to your CMS's security bulletin or check its admin dashboard regularly for flagged vulnerabilities.
4. Use strong, unique passwords and enable two-factor authentication
Weak or reused admin passwords remain one of the simplest ways in. A password that's used on another (possibly breached) site is effectively public.
- Use a password manager to generate and store long, unique passwords for every admin account.
- Enable two-factor authentication (2FA) on your CMS admin, hosting panel, domain registrar and email — these are the accounts that, if compromised, give an attacker control of everything else.
- Remove old staff or contractor accounts promptly when they no longer need access.
5. Back up your site — and actually test the restore
A backup you've never tested restoring is a backup you can't be sure works. Ransomware, a bad update, or a compromised plugin can all wipe out a site in minutes — a working backup is the difference between an afternoon of recovery and a permanent loss.
- Automate backups on a schedule that matches how often your content changes (daily for active e-commerce, weekly for a mostly-static brochure site).
- Store backups somewhere separate from your live server, so a server compromise can't take out the backups too.
- Periodically test an actual restore, not just confirm the backup file exists.
6. Set secure cookie flags
If your site uses cookies for sessions or login state, make sure they're set with the Secure, HttpOnly and SameSite flags — these stop cookies from being intercepted over an insecure connection, read by malicious scripts, or replayed by a cross-site attack.
7. Limit login attempts and monitor for suspicious activity
Automated bots frequently attempt "credential stuffing" — trying huge lists of leaked username/password combinations against your login form. Rate-limiting login attempts, and locking or flagging accounts after repeated failures, blunts this without inconveniencing real users.
8. Restrict admin access by role and location where possible
Not every staff member needs full admin access. Give people the minimum permission level they need to do their job, and if your platform supports it, restrict admin login to specific IP ranges or require a VPN for sensitive back-office access.
9. Check for known vulnerabilities in your third-party scripts
Analytics tags, chat widgets and other embedded JavaScript from third parties can carry their own vulnerabilities, and you're trusting that vendor's security posture along with your own. Periodically audit what third-party scripts are actually running on your site and remove ones you no longer use.
10. Run a security scan regularly — not just once
Security isn't a one-time checklist you complete and forget — new vulnerabilities are discovered constantly, and configuration can drift as you add plugins, change hosts or update your site. Make scanning part of a regular routine, not a one-off event.
siteIQ runs a full website audit covering security headers, SSL, known CVEs in your scripts, and more — for free, with no signup. Run your first scan now and work through the findings in priority order (critical and high-severity first).
Putting it all together: a simple monthly routine
- Run a security header and SSL check — confirm nothing has lapsed or drifted.
- Check for available CMS/plugin/theme updates and apply security patches.
- Confirm your last backup ran successfully, and spot-check that it's restorable.
- Review admin user accounts and remove anyone who no longer needs access.
- Skim your third-party scripts list for anything you no longer recognize or use.
None of this requires a dedicated security team or a large budget — it requires making these checks a routine instead of an afterthought. Most small business breaches exploit the basics that got skipped, not sophisticated attacks. Start with the free security scan and SSL checker above, fix what they surface, and set a recurring reminder to check again next month.