Building Your First Business Website: Security Essentials

Security problems do not announce themselves. A Houston contractor’s site can silently serve malware to visitors for weeks before anyone notices. A retail shop’s contact form can be harvested for spam databases overnight.

Small businesses are targeted not because attackers know your name, but because automated scanners probe millions of sites looking for easy entry points. According to the UK Government’s Cyber Security Breaches Survey 2025, 43% of businesses experienced a cyber breach or attack in the past year, most of them organizations without dedicated security staff.

This website security checklist covers what to confirm before and after launch, in the order that matters most. No technical background required.

In Part 7 we covered analytics setup. Part 9 is your full pre-launch checklist.

HTTPS and SSL certificates

The padlock icon in the browser bar confirms that data moving between your visitor and your server is encrypted. Without it, browsers label your site “Not secure,” and many visitors leave before reading anything.

Google reported in October 2025 that more than 95% of websites now use HTTPS. If yours is in the remaining 5%, the fix is fast: most hosting providers offer a free SSL certificate through Let’s Encrypt that installs in minutes.

What a valid certificate looks like and how to check yours

Visit your site in Chrome. A padlock icon to the left of the URL confirms the certificate is active. Click it, then “Connection is secure,” then “Certificate is valid” to see the expiration date. Certificates typically expire every 90 days (Let’s Encrypt) or one to two years for paid certificates. Set a calendar reminder two weeks before expiration or enable auto-renewal through your host.

Also verify that http://yourdomain.com redirects automatically to https://. Visitors who type your address directly could otherwise land on the unencrypted version.

Keeping software and plugins updated

If your site runs on WordPress, updates are the single most important security habit you can build.

Patchstack, the research organization that tracks WordPress vulnerabilities, documented 11,334 vulnerabilities in WordPress plugins in 2025, a 42% increase from the year before. Of those, 91% were in plugins rather than WordPress core. More striking: 57.6% required no authentication to exploit, meaning an attacker did not even need to guess a password.

Treat the update notification in your dashboard as a task. Update plugins within a few days of a new release, and remove any you no longer use. Deactivated plugins still contain exploitable code.

The same principle applies on any platform. Webflow, Shopify, and custom CMSes all have dependencies that need to stay current.

Strong passwords and two-factor authentication

Credential attacks are among the most common entry points for small business sites. Your admin login should have a password you have never used anywhere else, ideally generated by a password manager.

Two-factor authentication (2FA) adds a second verification step, usually a code sent to your phone or generated by an app. Even if someone steals your password, they cannot log in without the second factor. Enable 2FA on every account that touches your site: your CMS admin, your hosting account, your domain registrar, and your DNS provider. The FCC’s cybersecurity guidance for small businesses lists 2FA as one of the top 10 protective measures. It takes five minutes to set up and eliminates one of the most common attack vectors entirely.

Automated backups

A backup is only useful if it exists before something goes wrong. Set up automated daily backups before launch.

Most managed hosting providers include automated backups as a standard feature. Verify that backups are running (check the date of the last successful backup in your host’s dashboard) and that you can actually restore from them. Run a test restore to a staging environment once a year. The NIST Small Business Cybersecurity guide (May 2025) specifically calls out restoration testing as a required practice, not just backup creation. Most hosts support off-site backup to cloud storage at no extra cost.

For a financial services business like a tax preparation firm in Houston’s Galleria area, daily backups are non-negotiable. See how we built compliance-focused trust into the FM Tax website from the ground up.

What a basic security scan covers

Google Search Console (the free search performance dashboard you set up in Part 7) includes a Security Issues report under the sidebar navigation. Check it after launch and monthly thereafter. It shows whether Google’s crawlers have detected malware, deceptive pages, or harmful downloads on your site.

For a deeper scan, Sucuri’s free SiteCheck scanner crawls your public-facing pages for known malware signatures, blacklist status across major security databases, and visible signs of tampering. Run it before launch and any time something feels off.

Signs your site has been compromised

Knowing what to look for is as important as prevention. Common indicators include:

• Your homepage looks different than you designed it
• Visitors report being redirected to unfamiliar sites or seeing unexpected pop-ups
• Your browser shows a “Deceptive Site Ahead” warning when you visit your own URL
• Google Search Console’s Security Issues report shows a new alert
• You notice unfamiliar admin accounts in your CMS dashboard
• Your site’s traffic or rankings drop suddenly without a clear reason

If you see any of these, take the site offline and contact your hosting provider immediately. Do not try to diagnose it live while visitors may still be reaching it. We build security into client projects from the first discovery call, including for businesses where visitor trust is the product itself. See that in practice on the Delta Security Force project.

Pre-launch security checklist

Confirm each item before your launch date:

• HTTPS active sitewide, with HTTP redirecting to HTTPS
• SSL certificate valid with expiration date noted and auto-renewal enabled
• All CMS plugins and themes updated to current versions
• Unused plugins removed and deactivated
• Admin username is not “admin”; admin password is unique and strong
• Two-factor authentication enabled on CMS, hosting, and domain registrar accounts
• Automated daily backups configured and verified with a test restore
• Google Search Console connected and Security Issues report checked
• Free public-facing scan run (Sucuri SiteCheck or equivalent)
• At least one team member knows the process for taking the site offline quickly

What comes next

Part 9 covers the complete pre-launch checklist, the items beyond security that prevent surprises on day one.

Security and professional design reinforce each other in ways visitors feel even when they cannot name them. We explore that in how security signals combine with design to build customer trust.

If you want security built into your site from the first line of code, our web design services include it as a default.

---

Ready to build something secure from the start? Let’s talk about your project.

Frequently asked questions

How do I secure my small business website?

Start with the basics: confirm HTTPS is active (padlock in the browser bar), keep your CMS and all plugins updated, use unique strong passwords with two-factor authentication on every login, and set up automated daily backups. Once those are in place, run a free scan through Google Search Console’s Security Issues report to catch anything you may have missed.

What is an SSL certificate and does my site need one?

An SSL certificate encrypts the connection between your site and your visitors. Without it, browsers like Chrome flag your site as “Not secure,” which drives visitors away before they read a single word. More than 95% of websites now use HTTPS. If yours does not, your hosting provider can usually add a free certificate through Let’s Encrypt in minutes.

How do I know if my website has been compromised?

Warning signs include: your homepage looks different than you remember, visitors are being redirected to unfamiliar sites, a browser shows a “Deceptive Site Ahead” warning when you visit your own URL, Google Search Console shows a Security Issues alert, or you notice new admin accounts you did not create. If you see any of these, take the site offline immediately and contact your hosting provider.

Is WordPress secure for small businesses?

WordPress core is actively maintained and secure. The real risk is plugins: according to Patchstack’s 2025 security research, 91% of WordPress vulnerabilities are found in plugins, not the core software. Keeping plugins updated, removing ones you no longer use, and installing a reputable security plugin brings the risk down to a manageable level for most small businesses.