You lock your truck at night. You lock your shop. You lock the job site trailer. But what about your website? Most tradesmen never think about website security until something goes wrong — and by then, it is expensive, embarrassing, and time-consuming to fix.
Website security does not need to be complicated. Here are the essentials every small business website needs, explained in plain English.
Why Hackers Target Small Business Websites
You might think, "Why would anyone hack my plumbing website? I am not a bank." Fair question. But hackers do not target your website because of what you have — they target it because of what it can do for them.
According to Verizon's 2023 Data Breach Investigations Report, 43% of cyberattacks target small businesses. Hacked websites are used to:
- Distribute malware to your visitors (your customers get infected)
- Send spam emails from your domain (your email reputation is destroyed)
- Redirect visitors to scam sites, gambling pages, or worse
- Host phishing pages that steal credit card numbers
- Mine cryptocurrency using your server resources (and your visitors' browsers)
Small business websites are easy targets because they typically have outdated software, weak passwords, and no one monitoring them. A hacker with automated tools can scan thousands of websites per hour looking for known vulnerabilities.
The Must-Haves: Security Essentials
1. SSL Certificate (HTTPS)
If your website URL starts with "http://" instead of "https://," you have a problem. The "S" stands for "secure," and it means the connection between your visitor's browser and your website is encrypted.
Why it matters:
- Google Chrome (used by 65% of web users) marks HTTP sites as "Not Secure" with a visible warning. That warning alone will scare away customers.
- Google has confirmed that HTTPS is a ranking factor. HTTP sites are penalized in search results.
- If you have a contact form on an HTTP site, customer information (name, phone, email) is transmitted in plain text that anyone on the same network can read.
The fix: SSL certificates are free through services like Let's Encrypt, and most modern hosting providers include them automatically. If your host charges extra for SSL, that is a red flag about your host. Ask your web developer to set it up — it takes about 15 minutes.
2. Keep Software Updated
If your website runs on WordPress (about 43% of all websites do, according to W3Techs), keeping it updated is critical. WordPress core, themes, and plugins all receive security patches regularly. Running outdated versions is like leaving your front door unlocked.
Sucuri's research found that 39% of hacked WordPress sites were running outdated software at the time of the breach. Updates exist specifically because security vulnerabilities were discovered — not updating means you are knowingly running software with known holes.
The fix: Log into your WordPress dashboard at least monthly and install all available updates. Or better yet, enable automatic updates for security patches. If you are not comfortable doing this yourself, make sure whoever manages your site does it regularly.
3. Strong Passwords
This sounds basic because it is basic, and yet "password123" and "admin" are still among the most common passwords found on hacked websites. If your WordPress login password is your business name, your dog's name, or anything a human could guess in five tries, change it today.
The fix: Use a password that is at least 12 characters long with a mix of letters, numbers, and symbols. Even better, use a password manager like Bitwarden (free) or 1Password to generate and store complex passwords. And never use the same password for your website as you use for your email or bank.
4. Regular Backups
If your website gets hacked or corrupted, a recent backup is the difference between a 30-minute fix and rebuilding everything from scratch.
The fix: Make sure your website is being backed up at least weekly. Many hosting providers include automatic backups. If yours does not, WordPress plugins like UpdraftPlus (free) can back up your site to Google Drive or Dropbox automatically. Verify that your backups actually work by restoring one to a test environment at least once a year.
5. Remove Unused Plugins and Themes
Every WordPress plugin and theme installed on your site — even if it is not active — is a potential entry point for hackers. Plugins that have not been updated by their developers in over a year are particularly risky.
The fix: Go to your WordPress dashboard, look at your installed plugins and themes. Delete anything you are not actively using. If you have 20 plugins and only use 8, those other 12 are just adding risk with no benefit.
Warning Signs Your Site Has Been Hacked
Sometimes hacks are obvious — your homepage is replaced with a message in a language you do not read. But often, hacks are subtle and you might not notice for weeks. Watch for:
- Google search warning: Your listing shows "This site may be hacked" or "This site may harm your computer"
- Strange redirects: Visitors clicking your links end up on a different website
- New admin users: You see user accounts in your WordPress dashboard that you did not create
- Slow performance: A sudden, unexplained slowdown can indicate your server is being used for crypto mining or sending spam
- Customer complaints: People tell you your site "looks weird" or their antivirus flagged it
- Spam emails from your domain: You start receiving bounce-back notifications for emails you did not send
If you suspect your site has been hacked, act immediately. Take the site offline, contact your hosting provider, and get a security professional involved. The longer a hacked site stays live, the more damage it does to your reputation and your Google ranking.
The Static Site Advantage
Here is something most people do not know: the most secure website is one with no server-side code at all. Static websites — sites built with modern tools that generate plain HTML files — have virtually no attack surface. There is no database to hack, no login page to brute-force, no plugins to exploit.
A static site served from a CDN like Cloudflare is essentially unhackable through traditional methods. It is the same approach used by major companies for their marketing sites, and it works beautifully for service business websites. No WordPress vulnerabilities, no plugin updates, no security patches to worry about.
This is one of the reasons we build static sites for our clients — not only are they faster, but they are dramatically more secure than WordPress. Learn more about how we build websites that are fast and secure by design.
Your Security Checklist
Here is the minimum every small business website should have:
- SSL certificate (HTTPS) — free and non-negotiable
- All software updated to the latest version
- Strong, unique passwords for every account
- Regular backups stored off-site
- Unused plugins and themes removed
- Two-factor authentication on your admin login
- A monitoring service that alerts you to downtime or changes
None of this is expensive. None of it is complicated. But skipping it is a gamble that gets riskier every year. Protect your website the same way you protect your tools and your truck. Contact us if you want a website built with security as a foundation, not an afterthought.