Website security and backups for small businesses: a plain-English checklist

Your website is often the first place customers look, so a hacked or broken site costs you trust as well as sales. The UK's National Cyber Security Centre (NCSC) says 1 in 2 small businesses in the UK suffer a cyber incident a year. The good news is that a handful of plain habits makes a site much harder to attack and much easier to recover. This checklist is written for owners, not developers, in the UAE, the UK and Pakistan.

1. Keep everything updated

Updates often fix security holes. If your site runs on WordPress, that means WordPress itself, your theme and every plugin. Switch on automatic updates where you can, and delete plugins and themes you no longer use, because unused code can still be attacked. If a site has not been updated for months, ask your developer to review it.

2. Use strong, unique passwords and two-step login

Reusing one password across several accounts is risky: if one is leaked, criminals try it everywhere else. Give every account, including your hosting, domain and website admin, its own strong password. A password manager makes this easy, because it creates and remembers them for you, so you only need one strong password of your own.

Then turn on two-step verification where it is offered. It adds an extra layer of security, so a criminal who knows your password still can't get in. Start with email, hosting and the website admin login.

3. Back up your website, and keep a copy somewhere else

A backup is your way back if the site is hacked, broken by a bad update or deleted by mistake. Make sure backups run automatically, that they include both your files and your database, and that at least one copy is stored away from the website itself. A backup kept only on the same server can be lost along with the site. Ask your host or developer how often backups run and how long they are kept.

Then check that you can actually restore from one. A backup you have never tested is a hope, not a plan. Ask for a test restore once or twice a year.

4. Make sure your site uses HTTPS

HTTPS means the connection between your visitors and your site is encrypted, and browsers show a padlock. Without it, browsers may warn visitors that your site is "not secure", which puts customers off, especially if you take enquiries, bookings or payments. Most hosts offer a certificate at no extra cost. Check that it is switched on and that it renews automatically.

5. Limit who has access

Give each person their own login, and only the level of access they need. A staff member who writes blog posts does not need to be an administrator. Remove accounts straight away when someone leaves or when an agency finishes its work. Never share one admin login by email or chat. Fewer accounts with fewer powers mean fewer ways in.

6. If you think you have been hacked

Stay calm and work through these steps:

• Change the password on the hacked account straight away, and on any other account that used the same one.
• Turn on two-step verification, which adds an extra layer of security so a criminal who knows your password still can't get in.
• Check your backups, and restore from a clean copy if you need to.
• Report the incident. In the UK, GOV.UK has a page on where to report a cyber incident: gov.uk/report-cyber.

Do not pay anyone who contacts you out of the blue promising to fix the site. Speak to your host or a developer you already trust.

7. Your quick checklist

• Updates are on, and unused plugins and themes are removed.
• Every account has a strong, unique password, ideally kept in a password manager.
• Two-step verification is on for email, hosting and the website admin.
• Backups run automatically, include files and database, and a copy is stored elsewhere.
• You have tested a restore.
• Your site uses HTTPS.
• Everyone has their own login, with only the access they need.

No site is ever completely safe, and nothing here is a guarantee. But these habits cover the most common weaknesses, and most take under an hour to set up. If you would rather have someone do it for you, talk to us.