Small Business Website Security: 19 Questions Answered

Most small business owners think about website security exactly twice: when they build the site, and after something goes wrong. The gap between those two moments is usually years.

This is the conversation we have with clients who call us after the second moment. Written down, in advance, so you have the option of skipping it. Nineteen questions, in the order they normally come up.

1. Why would anyone target my site? I sell curtains in Kandy.

Nobody targeted you. That is the part people find hard to accept.

Almost every compromise we clean up started with an automated scanner working through a list of IP addresses, testing every site it finds for a handful of known weaknesses. It does not know what you sell. It does not know your revenue. It knows that a particular plugin version has a hole in it, and that you have that version installed.

Your site is not valuable to an attacker because of what it sells. It is valuable because it is a server with a clean reputation, a domain with some search authority, and an owner who is unlikely to notice anything for six weeks.

2. So how do sites like mine actually get hacked?

Four routes cover the overwhelming majority.

An out-of-date plugin or theme with a publicly documented vulnerability. A weak or reused admin password, found in a breach dump and tried automatically against your login page. Stolen hosting or FTP credentials, usually taken off an infected laptop rather than from the server. And supply chain: a plugin you installed years ago gets sold or abandoned, and the new owner ships an update with something extra in it.

Notice what is not on the list. Nobody wrote custom code to break into your curtain shop.

3. Is WordPress the problem?

No, though it takes the blame because it runs a large share of the web and its plugin ecosystem is enormous.

WordPress core is maintained carefully and patched quickly. The risk lives in the thirty plugins bolted onto it, of which nine are no longer maintained, four duplicate each other, and one was installed in 2021 to add a countdown timer to a sale that ended years ago.

The same applies to any platform with a plugin marketplace. The lesson is not "avoid WordPress." It is that every plugin is a dependency you have taken on and are responsible for.

4. What does "hardening" actually mean?

Reducing what is exposed and what an attacker can do once inside.

In practice: removing plugins and themes you do not use rather than deactivating them, restricting or renaming the admin login, enforcing two-factor authentication on every account with elevated access, setting correct file permissions, disabling file editing from inside the dashboard, adding security headers, and locking down the parts of the server that were never meant to be reachable from the internet.

None of it is exotic. Most of it is a day's work. Almost none of it is done on the sites we are called in to look at.

5. What can I check myself, today, for free?

Six checks. An hour of your time, and they catch the most common problems.

Search site:yourdomain.com on Google. Read past the first page. If you see pages you did not create — anything in a language you do not publish in, anything about casinos, loans, or pharmaceuticals — you have a problem right now.

Open Google Search Console and look at Security Issues, then Pages. Search Console will often tell you outright. If you have never set it up, set it up today. It is free and it is the closest thing you have to an alarm.

View the source of your homepage and search for <script src=. Every result should be a domain you recognise: your own, your analytics, your payment provider, your fonts. Anything else needs explaining.

Use URL Inspection in Search Console and click "View crawled page." Compare it to what you see in your browser. If they differ, that is cloaking, and it is one of the nastiest problems on this list. See question 10.

List the admin users in your CMS. Remove anyone who left, anyone you do not recognise, and the developer who built the site in 2019 and has not touched it since.

Find the date of your last backup, then find the date of the last time you restored one to check it worked. If the second date does not exist, you do not have backups. You have files.

6. My host says they handle security. Do they?

They handle their security. That is a different thing.

A good host patches the operating system, the web server, and the database, and keeps the machine itself from being compromised. What they do not do is update your plugins, audit your admin users, notice that your contact form accepts anything, or care that your password is your business name and the year.

Read the actual wording. "Secure hosting" almost always describes the building, not the contents.

7. Is HTTPS enough?

HTTPS stops someone reading the traffic between your visitor and your server. That is all it was ever supposed to do.

It does not stop a vulnerable plugin, a stolen password, or malware on your own machine. A hacked site with a valid certificate serves its malware over an encrypted connection, with a padlock in the address bar.

You need it. It is not a security programme.

8. How many plugins is too many?

Ask a different question: how many of these could you explain the purpose of, right now, without looking?

We have taken over sites with forty-plus plugins where the owner could account for maybe twelve. Every one of the other twenty-eight is code running on your server with access to your database, maintained by someone you have never met, and possibly by nobody at all.

Our working rule is that if a plugin has not been updated in twelve months, it is a liability regardless of whether it still works.

9. Are backups enough?

Backups are recovery, not defence, and they fail in a specific way that catches people out.

If you were compromised six weeks ago and only noticed today, your last four weeks of backups contain the compromise. Restore one and you restore the attacker. And even a clean restore puts you back on the same unpatched software that let them in, so you are re-hacked within days.

Backups matter enormously. They just answer a different question than the one people think they answer.

10. What is a cloaking attack, and why is it worse than defacement?

Because you never see it.

The attacker does not change what you see. They change what Googlebot sees. Your site loads normally for you, your staff, and your customers. When Google's crawler arrives, the server hands it hundreds of pages of gambling or pharmaceutical spam, indexed under your domain, borrowing the search authority you spent years earning.

You find out one of two ways: Search Console flags it, or your rankings collapse and you go looking for why. By that point the spam pages have often been indexed for months.

We have cleaned this up on our own property, which is a slightly humbling thing to publish and the reason we know exactly how long recovery takes. Removing the malicious code is day one. Getting the fake URLs de-indexed, submitting removal requests, rebuilding the sitemap, and waiting for Google to re-crawl and restore trust is three to six months.

11. What does a hack actually cost?

The cleanup is usually the cheapest part.

The real costs are downtime while you are offline, the search rankings you spend the next two quarters rebuilding, the customers who saw a browser warning on your domain and quietly went elsewhere, and — if payment or personal data was exposed — your notification obligations and whatever follows from them.

For most small businesses the cleanup is a few days of work. The SEO recovery is a season. Plan around the second number.

12. Do I really need two-factor authentication on everything?

On everything that can change your site or your money, yes, and it is the single highest-return thing on this list.

Two-factor authentication defeats the entire category of attack that begins with a leaked password, and that category is the largest one. Use an authenticator app rather than SMS where you have the option. Cover your CMS admin, your hosting control panel, your domain registrar, and the email account that can reset all three.

That last one is the account people forget, and it is the one that unlocks the others.

13. Something is hammering my login page constantly. Should I worry?

It is happening to everyone with a login page, all the time, and on its own it is background noise.

What you should do is make it irrelevant: rate-limit login attempts, lock accounts after repeated failures, enforce two-factor, and stop using predictable admin usernames. Once those are in place the attempts continue and stop mattering.

If the attempts suddenly become targeted — real usernames, correct email addresses, a burst from one source — that is a different signal and worth investigating.

14. Is Cloudflare or a WAF worth it?

For most small business sites, yes, on the free or cheap tier.

A web application firewall filters obviously malicious traffic before it reaches your server, absorbs the constant scanning, and buys you time when a vulnerability is announced and you have not patched yet. It also hides your origin server's address, which removes a category of direct attack.

It is not a substitute for patching. It is a layer that reduces how often the unpatched thing gets found.

15. What about my customers' data and card details?

Do not store card details. Ever. Let Stripe or your payment provider handle it, so the sensitive data never touches your server.

For everything else — names, addresses, phone numbers, order history — collect less, keep it for less time, and restrict who can export it. Most small business databases hold years of records nobody has looked at since the order shipped. That data cannot leak if it is not there.

If you operate in Sri Lanka, the Gulf, or serve customers in the EU or UK, you also have notification obligations after a breach. Worth knowing what they are before you need to know.

16. How often should I be updating things?

Security patches within a week. Everything else monthly.

The window that matters is between a vulnerability being published and being exploited at scale, and that window is now measured in days. Scanners are testing for newly announced holes within hours of disclosure.

If your site is business-critical, set up a staging copy so you can apply updates without gambling on a live site. If that sounds like more process than you want to run, that is a reasonable thing to hand to someone.

17. I think I have been hacked. What do I do in the first hour?

In order, and from a device you are confident is clean:

Take a full snapshot of the site and database before you change anything. It is your only evidence and you will want it. Put the site into maintenance mode rather than deleting things in a panic. Change your hosting, CMS, database, and email passwords, and force-log-out all active sessions. Tell your host — they may have logs you cannot see, and they may already know. Then check Search Console for what Google has recorded.

What not to do: restore a backup and assume it is over. That fixes the symptom, keeps the timeline, and leaves the door open.

18. What does a proper security audit cost?

For a typical small business site, a scoped audit and hardening pass sits in the low four figures USD, priced in LKR for Sri Lankan clients. That covers a full review, a written list of findings ranked by severity, and the fixes for the ones that matter.

Incident response — cleaning an active compromise and handling the search recovery — is priced separately, because the scope is not known until we are inside it. Anyone quoting a fixed price to clean a hack they have not seen is guessing.

Ongoing monitoring and patching is a small monthly cost and is where most of the value is, because security is a maintenance problem rather than a project.

19. Why is your initial scan free? What is the catch?

Security is easy to claim and hard for a buyer to verify, so the scepticism is fair. What you get is not a generic PDF with your logo on it, it is specific issues on your actual site. If we find nothing meaningful, we will tell you that and you can stop there. If we find things, you already know exactly how we work before deciding whether to hire us.

Where to start

Two options, both low commitment.

If you just want to know whether something is already wrong, run the six free checks above. It takes an hour and catches the most common problems.

If you want a real answer, ask us for the free initial scan. We will look at your site, tell you what we see, and give you a straight assessment of whether you need us. Sometimes the answer is no, and we will say so.

The one thing we would ask you not to do is assume that being small is protection. The scanners hitting your site right now do not know how big you are.

About the author

Lyle Heartman is the founder of ELRQ Agency, which builds and secures web platforms for businesses in Sri Lanka, the Gulf, and North America. Services include security audits, hardening, incident response, and post-hack SEO recovery. Request a free surface scan.