A Website Security Baseline for Small Businesses

Small businesses can improve website security with a manageable baseline: supported software, unique credentials, least privilege, tested backups, and monitoring. Security is a process, not a single plugin or scanner.

Keep the operating system, runtime, CMS, themes, plugins, and dependencies supported and patched. Remove abandoned extensions and accounts that no longer need access. Require multi-factor authentication for privileged users where possible, and use separate accounts instead of sharing one administrator login.

Protect secrets outside public directories and prevent debug output from exposing paths or environment values. Use HTTPS, validate uploads, restrict executable file types, and ensure database queries are parameterized through the framework's safe APIs. Apply rate limits to sensitive authentication and recovery endpoints.

Maintain backups in a location that an attacker who compromises the website cannot easily erase. Periodically test restoration, review login and file-change alerts, and document the first response steps for a suspected compromise. A short, rehearsed incident plan is more useful than a long plan nobody has tested.