Small Business Website Security Checklist: 12 Fixes to Make Before Your Site Gets Hacked

A small business website security checklist comes down to a short list of habits: keep the platform, plugins and themes updated, put multifactor authentication on every admin login, give each person their own account, keep automatic off-site backups you have actually restored, run HTTPS everywhere, and watch Google Search Console for security warnings. Most small business sites are not hacked by someone targeting you. They are hit by automated scans looking for a known hole in an outdated plugin or a reused password. Below: the twelve fixes in priority order, a table for who should own each one, how to tell whether your site is already compromised, and what to do if it is.

Why small business websites get hacked

Owners often assume their site is too small to be worth attacking. That misreads how most attacks work. Bots crawl the web around the clock checking for software versions with known vulnerabilities, default admin paths and weak logins. To a script, a Somerset County plumber and a national retailer look the same.

The data on WordPress, which runs a large share of small business sites, shows where the risk sits. Patchstack’s annual report found that 11,334 new vulnerabilities were found in the WordPress ecosystem in 2025, and 91% of them were in plugins, with only 6 reported in WordPress core. The same report says 46% of vulnerabilities did not get a fix from the developer in time for public disclosure. In plain terms: the core software is rarely the problem. The extra plugins your site has picked up over the years are.

The cost is not only the cleanup bill. When Google detects a problem, it can show your site with a warning label in search results or an interstitial warning page in the browser. For a local business that depends on people finding it on Google, that warning stops leads cold until the site is cleaned and Google reviews it.

The small business website security checklist

Work through these in order. The first five close the gaps that cause most compromises, and none of them needs a developer.

1. Turn on multifactor authentication for every admin login. That includes the website dashboard, your hosting account, your domain registrar and the email account that receives password resets. CISA puts it bluntly: using MFA on your accounts makes you 99% less likely to be hacked. Use an authenticator app rather than text messages where the platform allows it.
2. Give every person their own login, with the least access they need. No shared “admin” account passed between the owner, the office manager and the last web designer. An editor who posts blog updates does not need permission to install plugins. When someone leaves, you remove one account instead of changing a password everyone knows.
3. Update the platform, plugins and themes on a schedule. Turn on automatic updates for minor and security releases. Check for the rest weekly. Given how quickly attackers move on new vulnerabilities, “we update when we remember” is the most common gap we find.
4. Delete plugins and themes you do not use. A deactivated plugin is still code sitting on your server. Fewer plugins means fewer things to update and fewer doors to leave open. If two plugins do the same job, keep the one that is actively maintained.
5. Set up automatic off-site backups and test a restore. Daily backups stored somewhere other than the web server, kept for at least 30 days, so you can roll back to a version from before an infection. A backup you have never restored is a guess. Restore one to a staging copy once a quarter.
6. Force HTTPS on every page. Your SSL/TLS certificate should cover the whole site, including the contact form and any page that collects information, and plain HTTP should redirect to HTTPS. Most hosts include free certificates now; the step people miss is the redirect.
7. Lock down the domain registrar. Turn on registrar lock and MFA, and make sure the account is in the business’s name with an email address the business controls. Whoever controls the domain controls the website and the email.
8. Set up SPF, DKIM and DMARC for your email domain. These records stop scammers from sending email that looks like it came from your domain, and they help your own invoices and quotes reach inboxes. The FTC’s guidance for small businesses choosing a web host says plans with SSL/TLS and strong email authenticating technologies can better protect your business and your customers.
9. Protect your forms from spam and abuse. Add spam filtering or a challenge to contact and quote forms, limit file uploads to the types you need, and never email full form submissions containing sensitive details to a shared inbox. Our guide to website contact form best practices covers how to do this without hurting conversions.
10. Verify your site in Google Search Console. It is free, and it is how Google tells you about hacked content, malware or deceptive pages it finds on your site. Make sure the alerts go to an inbox someone reads.
11. Audit third-party scripts and chat widgets. Every tracking pixel, chat tool and embedded booking widget runs code on your pages. Remove the ones you no longer use, and check that any AI chat assistant only has access to the information it should share publicly.
12. Choose a host that patches and monitors the server. Hosting with no malware scanning or firewall puts the whole job on you; managed hosting or a static site removes much of the server-level risk.

Who should own each item

Security tasks fail when everyone assumes someone else is handling them. Assign each one to a named person, even if that person is you.

A lot of this overlaps with performance work. Removing unused plugins and scripts makes the site faster as well as safer, which is why we usually pair this checklist with the steps in our small business website speed guide.

How to tell if your website has already been hacked

Many compromises are invisible to the owner. Hackers often use cloaking, which Google describes as hacked content shown to search engines but not to you, so the site looks normal when you visit it. Google’s own guide on how to know if your site was hacked recommends registering the site in Search Console, checking the Security Issues section, and running a site: search on your domain to see every indexed page. Signs to look for:

• Pages in a site: search that you never created, often in another language or selling pharmaceuticals, replica goods or gambling.
• A warning in Google results or a red browser screen when customers visit.
• Admin users in your dashboard that nobody on your team added.
• Visitors on phones being redirected to a different site, while desktop visits look fine.
• Your host suspending the account or warning about outbound spam.
• Your business email suddenly landing in spam folders.

What to do if your site is compromised

1. Change every password and revoke sessions. Website admins, hosting, database, FTP or SFTP and the registrar. Turn on MFA as you go.
2. Find out how they got in. Cleaning infected files without closing the original hole means reinfection within days. The usual culprits are an outdated plugin or a stolen login.
3. Restore a clean backup or clean the site fully. Restoring from before the infection is fastest, followed immediately by updating everything. Otherwise, clean every file and database entry, not only the pages you noticed.
4. Request a review in Search Console. Google asks owners to fix the problems across the whole site, test the fixes, and then submit a review request from the Security issues report. Warnings come off after that review.
5. Check whether customer data was exposed. If your forms collected personal information, talk to your attorney about notification obligations. New Jersey has its own breach notification law, so get advice specific to your situation rather than guessing.

Website security vs office network security

This checklist covers your public website, its hosting and the accounts that control it. It does not cover the computers, Wi-Fi and file storage inside your office, which is a separate job with its own risks. For managed IT and office network security in New Jersey, our joint venture Connect Helm works with Watchman IT on that side. Many businesses need both, handled by different specialists.

Frequently asked questions

What is the most important website security step for a small business? Turning on multifactor authentication for every admin, hosting and registrar login, followed closely by keeping plugins and themes updated. Together they close the two most common ways small business sites are compromised: stolen passwords and known software holes.

Does an SSL certificate make my website secure? No. SSL/TLS encrypts the connection between the visitor and your site, which matters for forms and trust, but it does nothing to stop an attacker who gets in through an outdated plugin or a weak password. It is one item on the checklist, not the whole thing.

How often should a small business website be backed up? Daily for most sites, stored off the web server, and kept for at least 30 days so you can roll back past an infection you did not notice right away. Test a restore at least once a quarter.

Do I need a security audit if my site seems fine? A site can look fine while serving hidden spam pages to Google. A one-time audit checks software versions, user accounts, backups, email records and exposed files, and gives you a written fix list, which is cheaper than cleaning up after a compromise.

Get a second set of eyes on your website

Red Ridge AI builds and maintains websites for small businesses across New Jersey from our office in Branchburg. If you want this checklist done for you, our one-time website security audit gives you a written report, a prioritized fix list and a walkthrough call, with no contract. Book a call and we will tell you where your site stands. A monthly marketing and security checkup is also part of The Never-Miss-a-Job System.