Most small business sites aren’t targeted specifically — they’re caught by automated scans looking for known, unpatched vulnerabilities across thousands of sites at once. The basics below close off the overwhelming majority of that risk.
Keep everything updated, actually
The large majority of real website compromises trace back to a known, already-patched vulnerability in outdated software — a CMS, a plugin, a library — not a sophisticated targeted attack. Staying current is the single highest-leverage security step available.
Two-factor authentication on every admin account
A leaked or guessed password is a routine occurrence across the web. 2FA means that alone isn’t enough to get in, which closes off most account-takeover attempts at almost no cost to legitimate users.
HTTPS everywhere, properly configured
Not just on the login page — across the entire site, with modern TLS settings. This protects data in transit and is now also a baseline trust and SEO signal.
Backups that are actually tested
A backup nobody has ever restored from is a hope, not a plan. Regular, automated backups stored off the live server, with an occasional real restore test, are what actually make a compromise or a failed update a minor inconvenience instead of a crisis.
Least-privilege access
Not every team member needs admin access. Accounts should have the minimum access their role actually requires — it limits the blast radius if any single account is ever compromised.
None of this requires a security specialist on staff. It requires treating these five things as routine maintenance rather than optional extras.