Why do small business websites get hacked?
Most small business websites are not targeted personally. Automated bots scan millions of sites for known vulnerabilities in out-of-date software, weak or reused passwords and abandoned plugins, then exploit whatever they find. Attackers use compromised sites to send spam, host phishing pages, inject malicious redirects or steal customer data.
That is why routine hygiene beats clever tools. Applying updates promptly and controlling who can log in closes off the routes bots rely on. Our website maintenance and support plans exist largely to make that routine happen every month without fail.
Is HTTPS enough to make a website secure?
No. HTTPS encrypts traffic between the visitor and your server, so passwords and form data cannot be read in transit, and browsers flag sites without it as "not secure". But HTTPS does nothing to stop an attacker exploiting an outdated plugin or logging in with a stolen password. It is the baseline, not the finish line.
- Use a valid TLS certificate on every page and subdomain; free certificates from Let's Encrypt are widely supported by hosts.
- Redirect all HTTP requests to HTTPS with a permanent (301) redirect.
- Enable HTTP Strict Transport Security (HSTS) once you are confident every resource loads over HTTPS.
How should you manage updates, plugins and accounts?
Apply security updates to the CMS, themes, plugins and server software promptly, ideally within days of release. Remove any plugin or theme you are not using, avoid abandoned or pirated ("nulled") software, and give each person their own account with only the permissions they need. Turn on multi-factor authentication for every admin login.
Platform choice affects how much of this you inherit. A lean build with few dependencies has a smaller attack surface; our guide on WordPress vs a custom website covers the trade-offs.
- Updates: test on a staging copy first for business-critical sites, then apply to live.
- Plugin hygiene: fewer, well-maintained plugins from reputable developers; check when each was last updated.
- Multi-factor authentication (MFA): on the CMS, hosting control panel, domain registrar and email accounts.
- Least privilege: editors do not need administrator rights; remove accounts when people leave.
- Strong, unique passwords: stored in a password manager, never shared over email.
What makes a good website backup strategy?
A good backup strategy keeps automatic, regular copies of both files and database, stored off the server and away from your hosting account, with several restore points. Crucially, it is tested: a backup you have never restored is only a hope. Ransomware and compromised hosting accounts can delete backups stored alongside the site.
| Element | Good practice |
|---|---|
| Frequency | Daily for most sites; more often for busy shops or sites with frequent bookings |
| Location | Off-site, separate from the hosting account and its credentials |
| Retention | Several restore points, so you can roll back past an infection you notice late |
| Testing | Restore to a staging site periodically to prove it works |
Do you need a web application firewall (WAF)?
For most business websites, a web application firewall is worth having. A WAF sits in front of your site and blocks common attacks, such as SQL injection, cross-site scripting and brute-force login attempts, before they reach your server. Many CDN and managed hosting providers include one. It reduces risk but never replaces updates.
A CDN-based WAF can also absorb traffic spikes and some denial-of-service attacks, and often improves load times for UK visitors, which helps your Core Web Vitals.
Which security headers should a website send?
Security headers are instructions your server sends to browsers to limit what an attacker can do. The most useful are Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, a frame-ancestors or X-Frame-Options rule against clickjacking, Referrer-Policy and Permissions-Policy. They are cheap to add but need testing so they do not break legitimate scripts.
| Header | What it does |
|---|---|
| Content-Security-Policy | Limits which scripts, styles and other resources can load, reducing cross-site scripting risk |
| Strict-Transport-Security | Tells browsers to use HTTPS only for your domain |
| X-Content-Type-Options: nosniff | Stops browsers guessing file types in ways attackers can abuse |
| frame-ancestors / X-Frame-Options | Prevents your pages being embedded in other sites for clickjacking |
| Referrer-Policy | Controls how much of your URLs are shared with other sites |
| Permissions-Policy | Turns off browser features, such as camera or geolocation, that you do not use |
What does UK GDPR require if your website is breached?
If a breach affects personal data, UK GDPR requires you to report it to the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people's rights and freedoms. If the risk is high, you must also tell the affected individuals without undue delay.
You must also keep an internal record of every personal data breach, including those you decide not to report. UK GDPR expects "appropriate technical and organisational measures" to protect personal data, which for a website means the practices on this page. Contact forms, customer accounts and online shops all hold personal data, so this applies to most business sites.
Is Cyber Essentials worth it for a small business?
Cyber Essentials is a UK government-backed scheme, run with the National Cyber Security Centre (NCSC), that certifies five basic technical controls: firewalls, secure configuration, user access control, malware protection and security update management. It suits most small businesses and is required for some UK government contracts. Cyber Essentials Plus adds independent technical testing.
The controls overlap heavily with good website practice, so working towards certification and keeping your site well maintained support each other. As a typical UK market guide, ongoing website maintenance that covers updates, backups and monitoring costs around £30 to £100 per month excluding VAT, rising to £300 to £1,000+ for ecommerce or business-critical sites. Our guide to website maintenance costs in the UK explains what each level includes.
If you would rather not manage this yourself, get in touch and we will review where your site stands.
Prices are indicative typical UK market ranges, excluding VAT, not a Freehand HQ quote.