Most small business websites aren't hacked by someone who picked them out. They're found by automated tools that scan the internet day and night, looking for sites running old software or using weak logins. Being small doesn't keep you off the list. It usually means nobody is watching.
The good news is that most of the risk comes from a handful of things you can check yourself. Work through this list with a cup of tea and your website, hosting and domain logins to hand.
1. Make sure every page uses HTTPS
Visit your site and look for the padlock in the address bar. Then type your address starting with http:// (no "s") and check you're sent to the secure version automatically. If you're not, ask your host to switch on "force HTTPS". Most control panels have it as a single setting, and free certificates from Let's Encrypt renew themselves.
2. Check your PHP version
WordPress, WooCommerce, Joomla, Drupal and many older custom sites run on PHP. PHP 8.1 and older no longer get security fixes, and PHP 8.2's security support ends at the end of 2026. Log in to your hosting control panel, find the PHP settings and aim for 8.3 or newer. Take a backup first and check the site afterwards, because very old plugins sometimes break.
3. Update the website software, plugins and themes
Out-of-date plugins are the most common way into WordPress sites. Log in to your admin area and apply pending updates, and switch on automatic updates for minor releases if you can. If a plugin hasn't been updated by its developer in over a year, look for a maintained alternative.
4. Delete what you don't use
Every deactivated plugin, unused theme and forgotten test copy of your site (often at addresses like /old or /staging) is more code that can be attacked. If you're not using it, delete it rather than just switching it off.
5. Tidy up admin accounts
Look at the list of users who can log in to your website. Remove former staff, old web designers and anyone you don't recognise. Give everyone else the lowest level of access they need, and make sure nobody's username is "admin".
6. Turn on two-factor authentication
Two-factor authentication (a code from an app on your phone as well as your password) stops most password-guessing attacks dead. Switch it on for your website admin, hosting account, domain registrar and email. If someone gets into your domain registrar, they can take over your website and email in one go.
7. Use a password manager
Reused passwords are how one leaked account becomes five. A password manager (Bitwarden, 1Password and the one built into your browser all work) creates and remembers a different strong password for each login.
8. Check your backups actually work
Ask your host three questions: how often is my site backed up, how long are backups kept, and are they stored somewhere other than the same server? Then try restoring one, or ask your host to show you how. A backup you've never restored is a hope, not a plan.
9. Stop advertising your software versions
Many sites announce exactly which server software, PHP version and WordPress version they run. That tells automated attack tools what to try. Your host or developer can usually hide these with a couple of settings.
10. Add basic security headers
Security headers are instructions your site sends to browsers, such as "only ever load me over HTTPS" (HSTS) or "don't let other sites show me inside a frame". They're invisible to visitors, and many hosts or security plugins can add them for you.
11. Make sure you own your logins
Plenty of small businesses find out their domain, hosting or website is registered to a web designer who has since moved on. Check the domain is in your name and account, set it to auto-renew, and keep the hosting and website admin logins somewhere safe yourself.
12. Protect your business email
Scammers can send emails that look like they come from your domain unless three DNS records, SPF, DKIM and DMARC, are set up. We explain them in plain English in Stop scammers sending email as your business.
If you think you've been hacked
Change your hosting, website and email passwords from a clean device, turn on two-factor authentication, and contact your host. They can often restore a clean backup. If customer data may have been exposed, the ICO's website explains when you need to report a breach (within 72 hours for reportable breaches).
Get a quick outside view
If you'd like to know what your website reveals to anyone who visits, our sister service SecureSiteCheck runs a free quick check. It looks at your PHP version (where visible), HTTPS, security headers, CMS version and server exposure, without testing or attacking anything. For a full review, SecureSiteCheck also offers fixed-price assessments.
Disclosure: SecureSiteCheck is run by the same team as Future Tech Blog.
What's your biggest tech headache right now?
Tell us what you're struggling with. We'll write plain-English answers to the most popular topics.