Website security starts with a few basic steps that prevent a lot of trouble: keeping everything up to date, strong passwords with two-factor authentication, automatic backups and as few plugins as possible. Most hacks at small businesses are not targeted attacks, but automated scans looking for known weak spots.
That is good news, because you can protect yourself against them well. In this article you will read why small businesses are targets too, what the biggest risks are and which steps you can take today.
Why would anyone hack my website?
Many business owners think their site is too small to be interesting. But hackers rarely pick out a business. They let programs search the internet for sites with an outdated plugin or a weak password. Every site with a hole like that is a target.
A hacked site is often misused for things you don't notice straight away:
- Sending spam from your server or email address.
- Redirecting visitors to fake shops or scam sites.
- Placing hidden links to push other sites higher in Google.
- Stealing data from forms or customer accounts.
- Taking your site offline and demanding a ransom.
The consequences are a warning in Google, a blocked email address, loss of trust among customers and sometimes a data breach you have to report.
The biggest risks to your website
- Outdated software. The system, the theme or a plugin has a known hole that has already been fixed in a newer version.
- Weak or reused passwords for the admin area, hosting or email account.
- Too many people with admin rights, including former staff or previous developers.
- Plugins that are no longer updated by their maker.
- Forms without protection against spam and abuse.
- No backups, or backups stored on the same server as the site.
Website security checklist
Go through this list. You can sort out many points yourself, or check them in a few minutes with your developer or hosting provider.
- Keep the system, theme and all plugins up to date. Install security updates as soon as possible.
- Remove plugins and themes you don't use. Even deactivated plugins can be a risk.
- Use a long, unique password for every account. A password manager helps.
- Turn on two-factor authentication for your admin area, hosting, domain name and email. Then you need a code from your phone as well as your password.
- Only give admin rights to people who really need them, and remove old accounts.
- Make sure you have an SSL certificate, so your site runs over https. That is the padlock in the address bar.
- Set up automatic backups and store them somewhere other than the server.
- Protect forms against spam, for example with an invisible check field.
- Limit the number of login attempts, so nobody can keep trying passwords endlessly.
- Choose hosting that takes security and server updates seriously.
WordPress security: extra points to watch
WordPress is widely used, which makes it a popular target. The system itself is not insecure, but the huge number of plugins and themes makes it vulnerable when maintenance falls behind.
- Choose plugins from makers who actively maintain them. Check when the last update was.
- Don't use cracked or "free" versions of paid themes and plugins. They often contain malicious code.
- Use a username other than "admin".
- Turn on automatic updates for minor security updates, but test major updates first.
Do you need lots of plugins to make your site work? Then it is worth looking at WordPress or a custom website. A custom site has fewer third-party parts and so fewer ways in for attackers.
Website security and the GDPR
Do you collect personal data through your site, for example via a contact form, a client portal or an order? Then that falls under the GDPR (AVG in Dutch), the European privacy law. It requires you to take appropriate measures to protect that data.
If things do go wrong and personal data leaks, you may have to report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). What exactly applies in your situation is best checked with a lawyer or with the Autoriteit Persoonsgegevens itself. Practical advice: don't collect more data than you need, and don't keep it longer than necessary. What you don't have can't leak.
What to do if your website has been hacked
Notice strange pages, redirects or a warning from Google? Stay calm and work in this order:
- Contact your developer or hosting provider and report what you see.
- Change all passwords straight away: admin area, hosting, database, email and domain name.
- Restore a clean backup from before the hack, if you have one.
- Find out how the attacker got in and close that hole, or it will happen again.
- Check in Google Search Console whether Google shows warnings, and request a review after cleaning up.
- Work out whether personal data may have leaked and what you need to do if so.
Prevention is of course better. Good, regular website maintenance is the best protection there is.
A secure website with Violexa
At Violexa we build custom websites with as few third-party parts as possible. That makes a site faster and gives attackers fewer ways in. Forms get spam protection, and the site runs over https by default.
After launch you can hand the technical maintenance over to us. We have three plans: Silver for €179 (€217 incl. VAT), Gold for €299 (€362 incl. VAT) and Platinum for €699 (€846 incl. VAT) per month, excl. VAT. The first 12 months are fixed; after that you can cancel monthly by email with one month's notice. A new custom website starts from €1,799 excl. VAT (€2,177 incl. VAT). Read more about our approach under websites and apps.
Want to know how secure your site is? Book a free quickscan. In 30 minutes, online or on location, we look at your site together. Afterwards you get short written advice with a price indication, with no obligation.
Frequently asked questions
How do I know if my website has been hacked?
Signs include unknown pages or links, visitors being redirected to other sites, a warning in Google or your browser, or emails sent from your domain without you doing it. Also check the security issues report in Google Search Console. If in doubt, have someone take a look.
Is an SSL certificate enough to secure your website?
No. SSL makes sure traffic between the visitor and the site is encrypted, and that matters. But it doesn't protect against outdated plugins, weak passwords or a hole in your system. It is one part of the basics.
How do I stop spam through my contact form?
Use an invisible check field that only spambots fill in, or a spam filter. Limit the number of submissions per visitor in a short time. Don't ask for more data than you need.
Is WordPress insecure?
WordPress itself is not insecure, but it is a popular target. Problems usually come from outdated plugins, weak passwords or cracked themes. Good maintenance and few plugins reduce the risk considerably.
