Website security is not a badge installed at launch. It is a set of ordinary controls that remain owned when staff change, software updates and a supplier is unavailable. Small businesses benefit most from making those controls visible and repeatable.
Begin with an inventory, not a scanner. Record the domain registrar, DNS, hosting, content system, forms, payment provider, analytics and every account that can publish code or change settings.
Give each person their own account
Shared administrator logins remove accountability and make offboarding difficult. Create individual access with the lowest permissions needed. Remove old users promptly and review privileged accounts on a fixed schedule.
Enable multi-factor authentication on hosting, registrar, code repository, email and administrative access wherever supported. Protect the recovery email and codes as carefully as the main password. A password manager can generate unique credentials without staff inventing predictable variations.
Keep supported software current
List the operating system, framework, packages, plugins and third-party scripts the site relies on. Assign an owner to monitor security notices and test updates. Unsupported components need replacement or an explicitly approved containment plan.
Do not leave updates indefinitely because one change once caused a problem. Use a staging copy, versioned deployment and rollback plan so patches can be applied with controlled risk.
Back up what recovery actually needs
A database backup without uploaded files, configuration or encryption keys may not restore the service. Define the systems, frequency, retention and separate location. Limit access to backup stores and monitor failed jobs.
Schedule a restore test into an isolated environment. Record the time taken, missing dependencies and the point to which data returned. A successful backup notification is not evidence that recovery works.
Reduce exposure at forms and administration
Collect only fields the business uses and validate them on the server. Apply request limits, spam controls and file-type restrictions appropriate to the form. Store uploads outside executable paths and scan them when the workflow requires it.
Administrative routes should use secure transport, strong sessions and protection against forged requests. Avoid exposing debug output, secret keys or customer records in browser code and public logs.
Protect customer and business data
The ICO’s data security guidance describes measures as a risk-based decision rather than a single product. Document what personal information the website holds, why it is there, who can reach it and when it is removed.
Encrypt appropriate traffic and storage, but do not treat encryption as the whole control. Permissions, retention, staff practice and supplier arrangements determine whether protected information is still used safely.
Monitor events somebody can act on
- Repeated failed administrator logins or unexpected account changes.
- New privileged users, deployment keys or DNS changes.
- Malware warnings, altered files and unusual outbound traffic.
- Form delivery failures and sudden spikes in requests.
- Expired certificates, failed backups and overdue patches.
- Payment or integration errors that expose repeated retries.
Send alerts to an owned route with a response expectation. An alert nobody reads adds storage, not security. Keep logs long enough for the assessed need while avoiding unnecessary personal data.
Include suppliers in the control map
Record what the host, developer, platform and business each manage. Ask how urgent vulnerabilities are handled and how access is withdrawn. The contract should not leave both sides assuming the other applies updates or watches incidents.
Write an incident card before an incident
Keep a short, accessible list covering who can suspend the site, reset credentials, preserve evidence and communicate with customers. Include current supplier contacts and decision authority. Do not improvise deletion before logs and affected systems are understood.
Review legal and regulatory notification duties with appropriate advisers for the actual event. After recovery, record the cause, control changes and owner rather than closing the incident when the homepage reappears.
Sources and further reading
- NCSC Small Business Guide — UK National Cyber Security Centre guidance on accounts, backups, devices, malware and incident preparation.
- ICO guide to data security — the primary UK data-protection reference for risk-based organisational and technical measures.
Xapner’s website maintenance service can turn this baseline into an owned schedule, evidence log and recovery process for a specific site.