Website security basics

What your host handles

Server patching, network protection, the certificate that encrypts traffic, and the software your site runs on. On a hosted platform none of that is your work and none of it should be.

That is a genuine advantage of a hosted site over a self-managed one. The failures that make news are usually unpatched software, and a hosted platform removes that category entirely.

Confirm your site loads over a secure connection and that the certificate renews automatically. Our page on secure connections covers what that padlock does and does not mean.

Ask your provider what they cover if you are not sure. A clear answer about where their responsibility ends is genuinely useful, and a provider who cannot give one has told you something important.

Account access is the real risk

Nearly every small business site compromise starts with a login rather than a technical exploit. A reused password from an unrelated breach is the commonest route.

Use a unique password for your website account and turn on a second factor. That single pair of actions removes the large majority of realistic risk.

And review who has access. Old contractors, former staff and an agency you stopped working with frequently still hold accounts nobody revoked.

Give each person their own login rather than sharing one. A shared password cannot be revoked for one person, and nobody can tell afterwards who changed what.

What is actually yours to do

The list below is the whole of it for a hosted small business site. Anything beyond this is either the provider's job or is not proportionate to the risk.

• A unique password on the website account
• A second factor turned on
• Access removed when somebody leaves
• No more personal data collected than needed
• Form submissions not left sitting indefinitely
• A secure connection confirmed on every page
• Anything added to the site from a source you trust

Collect less

Data you never collected cannot be exposed. A form asking for a date of birth or an address you do not need is a risk taken for nothing.

The same applies to holding submissions forever. Our page on form data and retention covers how long to keep enquiries and why a policy matters.

This is the item most often skipped because it feels like a legal question rather than a security one. It is both, and reducing what you hold improves both at once.

Go through your forms once and remove every field you do not act on. Most business forms have accumulated two or three questions that nobody has read an answer to in years.

Be careful what you add

Every script, widget and plugin added to a site runs code you did not write. That is the one way a hosted site can still be compromised by something other than a login.

Add only what you need, from sources you would name to a customer. Our page on third-party scripts covers the privacy half of the same decision.

Remove what you stopped using. An abandoned widget keeps running and keeps being a route in, long after anybody remembers installing it.

Keep a short list of what is installed and why. Without one, nobody can tell an abandoned widget from a load-bearing one, so nothing ever gets removed.

What to do if something goes wrong

Change the password and revoke sessions first, before investigating anything. Nearly every incident on a site like yours is an access problem and that step ends it.

Then contact your provider. They can see things you cannot and they have handled the situation before, which is worth more than an hour of your own searching.

Then restore from a known-good copy rather than trying to clean in place. Our page on backups and versions covers why that copy needs to have been tested.

Then tell anybody affected. If personal data was involved there may be an obligation to notify, and the time limits on that are shorter than most businesses expect.