Many small business owners assume hackers aren’t interested in them. Unfortunately, most website attacks aren’t personal. Automated bots scan the internet constantly, looking for outdated plugins, weak passwords and misconfigured servers. When they find one, they don’t care whether the site belongs to a global brand or a family-run renovation company.
The consequences can be serious: defaced pages, spam links injected into your content, customers redirected to malicious sites, browser and search engine warnings, stolen customer data, lost sales and weeks of recovery work. For businesses that collect personal information, a breach can also create legal obligations.
The good news is that most website compromises are preventable with consistent, practical security habits. This checklist covers the 30 most important steps, organized so you can work through them in order.
Quick answer: To secure a small business website, enable multi-factor authentication, use strong unique passwords, limit admin access, keep your platform, themes and plugins updated, remove unused software, use reputable managed hosting with a web application firewall, enforce HTTPS, keep automated off-site backups you’ve tested, monitor for malware and downtime, authenticate your email domain with SPF, DKIM and DMARC, and have an incident response plan ready.
Key Takeaways
- Most attacks are automated and opportunistic; basic hygiene stops the majority of them.
- Outdated software and stolen or weak credentials are among the most common entry points.
- Backups are only useful if they’re off-site, recent and tested.
- Your domain, DNS and email accounts are part of your website’s security.
- Canadian businesses that collect personal information have breach reporting and record-keeping obligations under PIPEDA.
Why Small Business Websites Get Attacked
| Threat | What happens | Typical entry point |
|---|---|---|
| Vulnerable plugins and themes | Attackers exploit known flaws to gain access | Outdated or abandoned software |
| Credential attacks | Bots try leaked or common passwords | Weak or reused passwords, no MFA |
| Malware and SEO spam | Hidden links, spam pages or malicious redirects are injected | Compromised admin accounts or vulnerable code |
| Phishing | Staff are tricked into giving away logins | Email and fake login pages |
| Form spam and abuse | Bots flood forms or attempt injection attacks | Unprotected or poorly validated forms |
| DDoS and bot traffic | Sites slow down or go offline | Lack of protective infrastructure |
| Domain and DNS hijacking | Attackers take control of your domain or redirect traffic | Weak registrar security |
| Supply chain compromise | A trusted plugin, library or vendor is compromised | Third-party code |
Part 1: Access and Accounts
- Enable multi-factor authentication (MFA) on your website admin, hosting account, domain registrar, DNS provider, email and any connected tools. MFA blocks most attacks that rely on stolen passwords.
- Use a password manager and unique, long passwords for every account.
- Apply least privilege. Give each person only the access they need. Most content editors don’t need administrator rights.
- Remove old accounts promptly when staff, contractors or agencies stop working with you.
- Avoid shared logins. Individual accounts create accountability and make access easier to revoke.
- Limit login attempts and use bot protection on login pages.
Part 2: Software and Updates
- Keep your core platform updated — WordPress, your CMS or your e-commerce platform.
- Update themes and plugins promptly, especially security releases.
- Remove unused plugins, themes and apps. Deactivated software can still be a risk if it remains installed.
- Use reputable, actively maintained software from trusted sources. Avoid “nulled” or pirated premium themes and plugins, which frequently contain malware.
- Test updates on a staging site for complex or business-critical websites before applying them to production.
Part 3: Hosting and Infrastructure
- Choose reputable managed hosting with security monitoring, isolation between accounts, automatic patches and responsive support.
- Use a web application firewall (WAF) to filter malicious traffic before it reaches your site.
- Use a content delivery network (CDN) with DDoS protection to absorb traffic spikes and attacks.
- Keep server software current, including supported versions of PHP, databases and operating systems.
- Restrict file permissions and disable file editing from the admin dashboard where your platform allows.
Part 4: Data Protection
- Enforce HTTPS sitewide with a valid TLS certificate, and redirect all HTTP traffic to HTTPS.
- Collect only the data you need. Every piece of personal information you store is information you must protect.
- Secure your forms with validation, spam protection and safe handling of uploaded files.
- Use hosted payment providers so card data is processed by a PCI-compliant provider rather than stored or handled directly on your servers. This significantly reduces your security burden.
- Add security headers, such as Content Security Policy, HTTP Strict Transport Security and protections against clickjacking, configured to suit your site.
Part 5: Backups and Recovery
- Automate backups of files and databases, daily for active sites.
- Follow the 3-2-1 rule: keep at least three copies of your data, on two different types of storage, with one copy off-site and separate from your hosting account.
- Test restores regularly. A backup you’ve never restored is an assumption, not a plan.
Part 6: Monitoring
- Monitor uptime so you know immediately when your site goes down.
- Scan for malware and file changes to detect compromise early.
- Watch Google Search Console for security issues, manual actions and unusual new pages appearing in search results.
- Review logs and alerts for suspicious login attempts and admin changes.
Part 7: Domain and Email Security
- Lock down your domain: enable registrar lock, MFA and up-to-date contact details, and set domains to auto-renew so they never lapse.
- Authenticate your email domain with SPF, DKIM and DMARC. These standards help prevent criminals from spoofing your domain in phishing emails and improve deliverability for legitimate messages. Start DMARC in monitoring mode, review reports, then move toward a stricter policy.
Signs Your Website Has Been Hacked
- Browser or search engine warnings about your site
- Unfamiliar pages, links or keywords appearing in Google search results for your domain
- Unexpected redirects, especially on mobile or from search results
- New admin users you didn’t create
- Slow performance or unusual spikes in server resource use
- Customers reporting spam emails from your domain
- Modified files or unknown scripts in your site directories
- Your host suspending your account for malicious activity
What to Do If Your Website Is Hacked
- Stay calm and document what you see: take screenshots and note times.
- Contact your host and your web developer or security provider immediately.
- Change passwords for admin, hosting, database, FTP or SFTP, registrar and email accounts, and enable MFA where it’s missing.
- Take the site offline or show a maintenance page if visitors are at risk.
- Identify and remove the cause, not just the symptoms. Restoring a clean backup without closing the vulnerability often leads to reinfection.
- Restore from a known clean backup if appropriate, then apply all updates.
- Request a review in Google Search Console after cleanup if Google has flagged your site.
- Assess whether personal information was affected and follow your breach response obligations.
- Review and strengthen security so it doesn’t happen again.
Privacy Breach Obligations in Canada
Under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), organizations subject to the Act must report breaches of security safeguards involving personal information to the Office of the Privacy Commissioner of Canada when the breach creates a real risk of significant harm to individuals. They must also notify affected individuals and, in some cases, other organizations that can reduce the risk of harm. Organizations must keep records of all breaches of security safeguards for 24 months, whether or not they’re reportable.
Some provinces have their own private-sector privacy laws, including Quebec, Alberta and British Columbia. Quebec’s Law 25 includes its own incident reporting requirements. If your website collects personal information, include breach response in your security planning and seek professional advice when an incident occurs.
Build a Simple Incident Response Plan
Write down, in one place:
- Who to contact first (internal lead, developer, host, security provider, legal or privacy adviser)
- Where backups are stored and how to restore them
- How to access every critical account, protected by MFA
- How to assess whether personal information was involved
- How you’ll communicate with customers if needed
- How you’ll review and improve afterward
Review the plan at least once a year.
Platform-Specific Tips
WordPress
WordPress itself is actively maintained and secure when kept updated. Most WordPress compromises involve outdated or vulnerable plugins and themes, weak credentials or poor hosting. Keep plugins to a trusted minimum, enable automatic updates where safe, use a security plugin or managed security service, and disable file editing in the dashboard.
Shopify, Webflow and other hosted platforms
Hosted platforms manage server security and core updates for you. Your responsibility shifts to account security (MFA and staff permissions), third-party apps and integrations, domain and email security, and the data you collect.
Custom web applications
Custom applications need secure development practices: input validation, parameterized database queries, secure authentication, dependency updates, secrets management, logging and regular security testing. The OWASP Top 10 is a widely used reference for the most critical web application security risks.
Website Security as an Ongoing Process
| Frequency | Tasks |
|---|---|
| Daily (automated) | Backups, uptime monitoring, malware scanning, firewall protection |
| Weekly | Apply updates, review security alerts |
| Monthly | Review user accounts, test a backup restore, check Search Console |
| Quarterly | Remove unused software, review vendor access, check DNS and email authentication |
| Annually | Full security review, update incident response plan, renew training |
Frequently Asked Questions
Most attacks are automated. Bots scan for known vulnerabilities and weak passwords regardless of business size, then use compromised sites to host spam, steal data, send phishing emails or redirect visitors.
WordPress is secure when maintained properly. Most problems stem from outdated plugins and themes, weak passwords, too many administrators and low-quality hosting.
Active websites should be backed up at least daily, with copies stored off-site and separately from your hosting account. Test restores regularly to make sure backups work.
They are email authentication standards. SPF lists the servers allowed to send email for your domain, DKIM adds a cryptographic signature to messages, and DMARC tells receiving servers how to handle messages that fail checks and sends you reports.
Under PIPEDA, organizations must report breaches involving personal information to the Office of the Privacy Commissioner of Canada and notify affected individuals when there’s a real risk of significant harm. Provincial laws may also apply.
If your website is important to your business, a maintenance plan that covers updates, backups, monitoring and security response is one of the most cost-effective forms of protection.
Protect the Website Your Business Depends On
Your website is often the first place customers meet your business. Keeping it secure protects your reputation, your customers’ data and your revenue. Work through this checklist, automate what you can and treat security as an ongoing habit rather than a one-time fix.
Netxeno offers secure website builds and proactive maintenance plans covering updates, backups, monitoring, firewall protection, email authentication and incident response for businesses across Canada. Book a free website security check at netxeno.com/.
