Most small business website compromises are preventable with a short list of habits: keep software updated, protect every login with multi-factor authentication, take backups you have tested, give people only the access they need, and watch for warnings. None of this needs a security team. It needs an owner who treats the website like a shop front with a lock.
The five essentials
1. Keep everything updated
Old software is the most common way in. WordPress’s own security guidance is blunt: older versions are not maintained with security updates, and it recommends enabling automatic updates and keeping plugins and themes current (WordPress hardening). The same principle applies to any platform: website builders, e-commerce systems, booking plugins and the server environment.
Practical steps:
- List every piece of software your site depends on, including plugins, themes and third-party scripts.
- Remove what you do not use. WordPress advises deleting unused plugins and installing only from trusted sources.
- Decide who is responsible for updates and how often they are checked.
2. Use multi-factor authentication
A password is the weakest link. WordPress’s guidance describes two-step authentication as a second proof of identity beyond the password, and notes that the weakest link in the security of anything you do online is your password (Two-step authentication). Turn it on for your website admin, hosting account, domain registrar, email and any payment or marketing platform connected to the site.
Prefer an authenticator app over text messages: the WordPress documentation notes that SMS is not a secure channel. Plan for lockouts too, such as keeping recovery codes somewhere safe.
3. Keep tested backups
A backup you have never restored is a hope, not a plan. For a database-driven site, WordPress’s backup guidance says you need both the database and the files, because a files backup does not include the database (WordPress backups). It suggests weekly backups for small sites and daily for high-activity ones, keeping several recent copies, storing them in more than one place, and always backing up before an upgrade.
Also ask your host what it backs up and how quickly you could get a copy. Host backups are useful but can be slow to retrieve.
4. Apply least privilege
Everyone who logs in should have the smallest role that lets them do their job. A person who writes blog posts does not need to install plugins. Practical habits:
- Give each person their own account. Do not share one login.
- Avoid obvious usernames such as “admin”.
- Remove accounts when contractors finish or staff leave.
- Use encrypted connections: HTTPS for the admin area and SFTP rather than plain FTP.
5. Watch for warnings
Google Search Console’s security issues report flags hacked content, malware and deceptive pages, and affected pages may show a warning in search results or a browser warning (Security issues report). Check it periodically and make sure the right person receives its notifications.
Quick checklist
| Area | Question to ask |
|---|---|
| Updates | Is every plugin, theme and core system current? |
| Logins | Does every admin account use MFA and a unique password? |
| Backups | When did we last restore a backup successfully? |
| Access | Who has admin rights, and do they still need them? |
| Monitoring | Does anyone read security warnings? |
If the site is hacked
Do not panic and do not delete things blindly. Google’s guidance is to fix the issue throughout the site, not only on some pages, and then request a review once every listed issue is resolved. It also advises against opening suspected infected pages directly in a browser: use the URL Inspection tool or a command-line fetch instead. In practice this usually means restoring a clean backup, updating everything, changing all passwords and removing unknown accounts, ideally with professional help.
If customer data may be involved, you may have notification obligations under Australian privacy law. That depends on your circumstances, so treat this as general information and seek professional advice.
Limits of a checklist
These steps greatly reduce risk but do not remove it. Platform choice matters too: a static site has fewer moving parts than a plugin-heavy CMS, a trade-off explored in Astro vs WordPress. Automations that connect your site to other tools also need care: see AI automation for business operations. And a secure site that does not convert is still a poor investment, so read what makes a business website convert.
Where Radiance Impact fits
Radiance Impact’s Technology team builds business websites and offers maintenance and care. If you want a second opinion on how your site is set up, see /technology or contact us.
Sources
- Hardening WordPress, WordPress.org Developer Resources
- Two-Step Authentication, WordPress.org Developer Resources
- WordPress Backups, WordPress.org Developer Resources
- Security issues report, Google Search Console Help
