Website Security Without a Developer

Most small business sites aren't targeted deliberately. They're found by automated scans looking for known, unpatched weaknesses — which is good news, because the fixes are boring and you can do most of them yourself.

The short answer

Six things, in order of how much they matter:

• Keep everything updated — platform, plugins, themes. Unpatched software is how most sites get compromised.
• Use strong, unique passwords and turn on two-factor authentication on hosting, CMS and domain accounts.
• Remove what you don't use — every unused plugin, theme and old admin account is a door you're not watching.
• Keep the SSL certificate valid so the site doesn't warn visitors away.
• Keep working, off-server backups — the thing that turns a disaster into an afternoon.
• Limit who has admin access, and remove people when they leave.

None of that requires a developer.

Why updates matter more than anything else

When a vulnerability is found in a popular plugin, two things happen: the developer releases a patch, and the details become public. From that moment, automated scanners start sweeping the internet for sites that haven't applied it.

Your site isn't chosen. It's found. Which means the defence isn't cleverness — it's not being one of the unpatched ones. Set updates to automatic where your platform allows it, and where it doesn't, put a monthly reminder in your calendar. That single habit prevents most of what happens to small business sites.

The passwords conversation, briefly

Yes, it's tedious. It's also where a real share of compromises start.

Three accounts matter most: hosting, CMS admin, and your domain registrar. Unique passwords on each, stored in a password manager, with two-factor authentication turned on. The registrar is the one people forget, and it's the account that controls everything else — lose it and you lose the address itself.

Delete what you're not using

Every plugin, theme and admin account you don't need is surface area. The old developer's admin login from two years ago. The three plugins you trialled and abandoned. The theme you switched away from but never removed — still installed, still unpatched, still exploitable. Deleting things is the cheapest security work there is.

What actually needs someone technical

Recovery after a compromise. If a site is hacked, cleaning it properly means finding what was changed, what was left behind, and how they got in. Restoring a backup without closing the hole just resets the clock.

Server-level configuration — firewall rules, permissions, anything below the CMS. If it isn't a setting in your admin panel, it isn't your job.

When you're already fine

If your site is a small static build with no CMS, no plugins, no logins and no database, sitting on managed hosting — there's very little to secure and very little to attack. Keep the SSL valid, keep the accounts locked down, and get on with running your business. Not every site needs a security posture.

What I'd recommend

Do the six things in the short answer once, properly. Then a monthly ten-minute check: updates applied, site loads, backup exists, SSL valid, no unfamiliar admin accounts. That's more than most small business sites get, and it prevents most of what goes wrong.

Frequently asked questions

Can a small business website really get hacked?

Yes, and usually not because anyone targeted it. Automated scans look for known unpatched vulnerabilities across the whole internet. Being small doesn't hide you; being updated protects you.

Do I need a security plugin?

On a plugin-based platform they can help — but they don't substitute for updates, strong passwords and backups. A security plugin on an unpatched site is a lock on an open window.

What do I do if my website is already hacked?

Get help. Cleaning a compromised site properly means finding the entry point, not just restoring a backup — restore without closing the hole and it happens again. What to do when your website goes down covers the first hour.

Is WordPress less secure than a custom site?

Not inherently — but it has far more third-party plugins, which means more code from more authors to keep patched. The risk is the maintenance burden, not the platform. Whether you need a maintenance plan turns largely on this.

How often should I check my website's security?

Ten minutes a month covers it for most small sites: updates, backups, SSL, admin accounts.

Where to start

Do the ten-minute check this week rather than planning a bigger one you won't do. If you want a second pair of eyes, send me the address and I'll tell you what's visible from outside — including that there's nothing to worry about, if that's the case. Get in touch.