Key takeaways
- Use HTTPS, keep your CMS and plugins updated, and turn on multi-factor authentication.
- A web application firewall helps block common attacks such as SQL injection and cross-site scripting.
- Keep automatic backups stored separately from your website, and test restoring them.
Securing your business website comes down to a handful of routine habits: encrypt traffic, keep software updated, control who has access, block common attacks and keep tested backups. These steps don't require a large security team, but they do need an owner and a regular schedule. This guide explains each one in plain terms.
Use HTTPS with an SSL certificate
An SSL/TLS certificate encrypts the information travelling between your website and your visitors' browsers, so forms and logins can't be read in transit. Most hosting providers can issue one automatically. Check that every page loads over https:// and that http:// addresses redirect to it. Browsers warn visitors about pages that aren't secure.
Keep your software updated
Outdated software is a common way into a website. Regularly update your content management system (CMS), plugins, themes and any other components, because developers release updates to fix security vulnerabilities. Schedule a recurring check rather than waiting for a problem.
Require strong, unique passwords
Weak or reused passwords are an open invitation to attackers. Require long, unique passwords for every account with access to your website, and avoid sharing logins between staff. A password manager makes this practical.
Turn on multi-factor authentication
Multi-factor authentication (MFA) asks for a second form of verification, such as a code from an authenticator app, as well as a password. Even if a password is stolen, MFA adds a significant barrier to unauthorised access. Turn it on for your website, hosting and domain accounts.
Add a web application firewall
A web application firewall (WAF) monitors traffic before it reaches your website and helps block common attacks such as SQL injection and cross-site scripting (XSS). The OWASP Top Ten is the standard reference for these risks if you want to understand them in more detail.
Back up your website and test the backups
Backups let you restore your site after a breach, a failed update or a simple mistake. Back up both files and the database automatically, store the copies separately from the website, and test restoring them. An untested backup may not work when you need it.
Remove what you don't use
If your website runs on a CMS like WordPress, every unused plugin, theme or user account is something an attacker could exploit. Delete anything you no longer need, install plugins only from reputable sources, and limit administrator accounts to the people who need them.
Review your website security regularly
Security isn't a one-off job. Review your code, configuration and access permissions on a regular schedule, and remove access promptly when people leave or suppliers change. The Australian Government's business.gov.au also publishes cyber security guidance for businesses.
Getting help
If you would like a second opinion, our IT consulting and managed services include IT security and risk assessments. You can also use our website hosting and maintenance checklist to review the basics yourself, or book a consultation.
Common questions
What is the first step to secure a business website?
Make sure every page loads over HTTPS with a valid SSL certificate, then check that your CMS, plugins and themes are up to date. Both are usually quick to check.
How often should I update my website software?
Check regularly on a recurring schedule and apply security updates promptly. Developers release updates to fix known vulnerabilities, so delays leave your site exposed.
Do small business websites get attacked?
Yes. Many attacks are automated and look for known weaknesses in any website, regardless of the size of the business behind it.
Further reading
About the author
Madhab Dhakal started out as a sole trader in Sydney in 2019 while studying for a Master of Information Technology. After moving to Perth, he founded Code Venture as a company in 2023, and leads it as CEO.