Website Security Basics for Small Business Owners

You do not need to be a security expert to protect a small business website. Most break-ins come from simple things: weak or reused passwords, out-of-date software, no backups and forms left open to spam. Cover those five areas and you remove most of the easy ways in.

Why small sites get targeted

It is tempting to think nobody would bother with a local aircon or tuition site. But attacks are mostly automated. Bots scan the internet for known weaknesses and try common passwords. They do not care how big you are.

The damage is real: a defaced page, hidden spam links, a site that Google warns people away from, a stolen mailing list or a week offline. Prevention is far cheaper than recovery.

1. HTTPS: the padlock you should have

HTTPS encrypts the connection between your visitor and your site, so details sent through a form cannot easily be read in transit. Browsers flag sites without it as not secure, which is not a good first impression.

What to check

• Open your site and look for the padlock or secure indicator in the address bar.
• Type the address starting with http:// and make sure it redirects to https://.
• Check that images and scripts load securely too, so there is no mixed-content warning.
• Ask who renews the certificate. Many hosts do it automatically, but confirm it.

HTTPS protects data in transit. It does not make a site immune to hacking, so it is a starting point and not the whole job.

2. Updates: boring and essential

Software has flaws, and when one is found it gets published. Attackers then scan for sites still running the old version. Updating closes the door.

That applies to everything your site relies on:

• the platform or CMS itself,
• themes, plugins and apps,
• the server software your host runs,
• any third-party scripts you embed.

Fewer plugins means fewer things to update. Delete anything you no longer use rather than just switching it off.

Ask the provider a plain question: who updates the site, how often, and what happens if an update breaks something? Our website maintenance guide covers what ongoing care should include.

3. Passwords and two-factor authentication

Most accounts are lost because someone guessed or reused a password. If one leaked password lets a stranger into your site, domain and email, that is a single point of failure.

Protect your email first

Your email is the master key. If someone controls it, they can reset the password to everything else. Put your strongest protection there, including 2FA.

Watch for phishing

A message that looks like it comes from your host, bank or courier and asks you to log in is a common trick. Do not click the link. Open the service in your own browser and check from there.

4. Backups: your safety net

If something goes wrong, a recent backup lets you roll back. Without one, you may lose pages, photos, orders and form entries.

Ask these questions:

• How often are backups taken, and how long are they kept?
• Are they stored away from the server they back up?
• Can you or your provider restore a full copy, and how long does it take?
• Has a restore ever actually been tested?

5. Forms, spam and unwanted visitors

Open forms attract bots. Spam is annoying, and a flood of fake entries can bury real enquiries or fill your inbox. Some spam also tries to push malicious links.

Practical protections

• A honeypot field, a hidden box that bots fill in and people do not.
• A verification step such as a challenge that blocks automated submissions.
• Rate limits so one source cannot send hundreds of messages.
• Server-side checks, so the form does not rely only on the browser.
• Clear alerts when a form stops delivering, so real enquiries are not lost.

Spam protection should not make real customers jump through hoops. A form that is too hard loses genuine enquiries, and a WhatsApp button next to it gives people an easier route. See adding a WhatsApp button to your website.

6. Know who has the keys

Security is also about people. Write down every account connected to your site: domain, hosting, website admin, analytics, email, social, and any chat or form tools. Note who has access and whether it is under your name.

If a former agency still owns the hosting or domain, you are depending on a relationship that may have ended. Sort that out now. See who owns your website and the domain name guide.

Personal data

If your site collects names, numbers or messages, you also have duties under Singapore's PDPA to protect that data. Check the current guidance at pdpc.gov.sg and read PDPA for website owners. This is general information and not legal advice.

If you think your site has been hacked

Warning signs include pages you did not create, odd redirects when visitors click from Google, a browser or search warning, admin users you do not recognise, sudden slowness, or customers saying they got strange emails from your address. Do not panic and do not delete things at random. Work in order.

If the site collected personal data and that data may have been exposed, there may be duties to assess and report under the PDPA. Check the current data breach guidance at pdpc.gov.sg and get advice early. This is general information, not legal advice.

Which fixes matter most for your site?

Time and budget are limited, so start with the changes that cost the least and protect the most.

Advanced tips once the basics are done

• Use a staging copy: test updates on a duplicate site first, so a broken plugin does not take down the live one.
• Separate roles: give writers an editor role, not an admin role. Fewer admins means fewer high-value accounts to protect.
• Limit login attempts: many platforms can lock out repeated failed sign-ins. Ask your provider whether this is on.
• Review third-party scripts: every chat widget or tracker you embed runs code from someone else. Keep only the ones you use.
• Keep an inventory: a simple list of accounts, owners, renewal dates and who holds recovery codes saves hours in a crisis.
• Plan for the person who leaves: write down what to switch off when a staff member or freelancer moves on.

A second scenario: the shared login

A small renovation firm lets its designer, its office admin and a part-time marketer all use one admin login for the website, which is also the password for the company email. When the marketer leaves on bad terms, nobody knows whether to change it, and changing it would lock out everyone at once.

The fix is dull but effective: individual accounts, 2FA, a password manager with a shared vault for the few accounts that genuinely need to be shared, and a written leaver checklist. The owner also moves the domain and hosting into the company's own name, which she had not realised was still under the designer's personal account.

A worked scenario: the hacked tuition site

A tuition centre's WordPress site starts showing strange pages when searched on Google. Their web designer from three years ago is not answering. The plugins have not been updated in a long time, the admin password is the centre's name plus a year, and there is no backup.

Cleaning it up takes days. The owner changes every password, enables 2FA, removes unused plugins, restores a clean copy from their host and sets up automatic backups. The lesson is simple: none of those steps were hard to do beforehand.

What to ask a web provider

Your next step

Today, turn on 2FA for your email and domain, and ask your provider about backups. Then work through the question list above. If you want a site that is built and set up with the chat, reply and review tools around it, see what Website.sg includes. Keep reading with the hosting guide, who owns your website and the website speed guide.