Most breaches exploit simple mistakes. A practical checklist for keeping your website and customers safe.
Small businesses often assume they're too small to be targeted. In reality, most attacks are automated and indiscriminate — bots scanning for outdated plugins, weak passwords and exposed admin panels. The good news is that the basics stop the vast majority of them.
Keep everything updated
Outdated CMS cores, plugins and dependencies are the most common entry point. Automate updates where possible and remove anything you no longer use.
Lock down access
- Enforce two-factor authentication on every admin and hosting account
- Give each person their own login with the minimum permissions they need
- Remove access promptly when someone leaves
- Store secrets in environment variables, never in code
Encrypt and harden
HTTPS everywhere is a given. Add security headers — Content-Security-Policy, Strict-Transport-Security, X-Frame-Options — to block whole categories of attacks with a few lines of configuration.
Validate every input
Contact forms, search boxes and checkout fields are all doors into your system. Validate and sanitise input on the server, use parameterised queries, and rate-limit forms to stop spam and brute-force attempts.
Plan for the bad day
Automated, off-site backups — tested regularly — turn a potential disaster into an inconvenience. Know who to call and what to do if something goes wrong.
Security isn't a product you buy once. It's a habit you keep.