Website security basics for small business: what to require and what to ask, no tech skills needed

Basic security for your business website comes down to four things you can require without knowing anything technical: logins registered to your business, backups that actually work, someone responsible for updates, and a clear plan for when something breaks.

I'm not going to explain how a website is secured on the inside. That's the job of whoever builds it. What I can give you is the list of what you, as the owner, should ask for and the questions you should ask. That's enough to tell whether your site is in good hands.

First: make sure you hold the keys

The most common security problem for small businesses isn't a hack. It's not having the keys. The domain is registered to the nephew who built the first site, an agency you no longer work with controls the email, and nobody knows the password to the account where the site is hosted. When something goes wrong, you're stuck.

Insist that your domain, email and hosting accounts are in your business's name, tied to an email address you control. Your developer can have access to do the work, but ownership stays with you. If your domain isn't sorted yet, see custom domain and business email.

Four things to require

• Logins in your name, one per person. Everyone who uses your site's admin gets their own login. When someone leaves, you remove theirs without changing everyone else's password.
• Passwords that never travel by chat. Don't send them over WhatsApp or tape them next to the register. And on the important accounts, turn on a second step, like a code sent to your phone.
• Backups someone has tested. “They happen automatically” isn't enough. Someone has to have checked that they can actually be restored. I go into it in backups for business software.
• Updates with a named owner. Every website needs updating now and then. It should be written down who does it and how often, even if it's just “I check it once a month.”

Questions to ask whoever builds your site

Your customers' data

If your site has forms, bookings, orders or a store, you're storing people's information: names, phone numbers, addresses, sometimes more. The most useful rule is simple: keep only what you need to serve them. What you never store can't be lost.

Then decide who on your team sees what. The person taking bookings doesn't need the sales figures, and the person at the register doesn't need a pet's medical history. Data privacy rules depend on where you operate, so for the legal side, check with your accountant or a local professional.

Signs something is wrong

You don't need to watch your site every day, but some things shouldn't be ignored: an email saying someone tried to log into your account, customers telling you the site looks odd or sends them somewhere else, forms suddenly filling up with junk, or your site showing up on Google with text you never wrote.

If you notice any of that, tell whoever maintains your site right away. The sooner it's looked at, the easier it is to fix. And if there's nobody to tell, that's the first problem to solve.

When you switch providers

If you're moving away from whoever built your site, ask them to hand everything over first: logins, backups and a list of where everything lives. Then change the passwords and remove the accounts that no longer belong. It isn't distrust. It's the same as changing the locks when you move.

This applies to every digital tool in your business. For 3D configurators, I covered it in who owns your 3D configurator. And for what happens to a site in the months after it goes live, read what happens after your website launches.

Frequently asked questions