Website Security for Small Business

Start with the controls that reduce common risk

The Australian Cyber Security Centre's small-business guidance highlights multi-factor authentication, software updates and backups as important starting points. Those same foundations apply directly to website administration, hosting and the systems around a business website.

• Turn on multi-factor authentication for website, hosting, domain, DNS and business email administration wherever it is available.
• Install security updates for your CMS, plugins, themes, frameworks, server software and other dependencies promptly.
• Maintain regular backups of the website, database and important configuration, and confirm that recovery is actually possible.
• Remove accounts, plugins, integrations and internet-facing services that are no longer required.

Protect administrator access

Administrator access is especially valuable because it can change content, settings, users and sometimes hosting or payment integrations. Use individual accounts where practical, restrict privileges to what each person needs and remove access when staff or suppliers no longer require it.

Multi-factor authentication adds a second barrier when a password is stolen or reused elsewhere. A password manager can also help staff use strong, unique credentials instead of sharing or recycling passwords.

Keep the website platform and dependencies current

Known weaknesses are routinely fixed through updates. A website can remain exposed when its CMS, plugins, libraries, server packages or other components stop receiving security fixes or are left behind on old versions.

Where possible, know who is responsible for updates, how quickly important fixes are applied and what happens when a component becomes unsupported. Fewer unnecessary plugins and integrations also means fewer components to maintain and fewer potential entry points.

Protect the public-facing configuration

HTTPS should protect traffic between visitors and the website. Browser-facing security headers can add controls around framing, content loading and other behaviours. Domain email should also publish appropriate SPF, DKIM and DMARC records where email is sent using the domain.

These controls solve different problems and none of them proves that the application behind the website is secure. They are useful layers in a broader security posture.

Plan for recovery as well as prevention

Backups matter only if they contain what the business needs and can be restored. Include website content, databases and configuration that would be needed to rebuild service, and periodically test the recovery process rather than assuming a backup job is sufficient.

Also record who manages the domain, hosting, website and key integrations so the business knows whom to contact if the website is unavailable or compromised.

Check what the internet can see

External checks provide a different view from internal administration. They can help surface publicly visible configuration issues and changes in exposure without requiring access to the website server or CMS.

That external view should complement, not replace, secure development, patching, access management, backups and deeper security testing when the website's risk warrants it.