Why would anyone attack a small business website?

They usually are not attacking you specifically. Automated tools scan for known vulnerable components, and any site that matches is used for spam hosting, link injection or malware distribution.

Is managed hosting enough?

Managed hosting usually covers the server and sometimes CMS core, but rarely your plugins, themes, user accounts or content. Confirm the boundary in writing.

Website Securitybeginnerguide

Small Business Website Security

No security team, no budget line, real risk. The five controls worth your limited time, and the two questions to ask your web supplier.

Cyber Security Space editorial desk · Published 25 Jul 2026 · Updated 25 Aug 2026 · 3 min read · Reviewed 25 Aug 2026

Short answer

For a small business site the five controls that remove the most risk are: multi-factor authentication on every administrative account, someone named as responsible for updates, off-site backups that have been restore-tested, removal of unused plugins and accounts, and a monthly check of what search engines have indexed.

Key takeaways

Small sites are attacked opportunistically and automatically, not because anyone targeted the business.
Ownership is the missing control more often than any piece of technology.
Domain and DNS accounts deserve the same protection as the CMS — losing them is worse.
Two written questions to a supplier resolve most ambiguity about who patches what.

The five controls worth your time

Turn on multi-factor authentication for the CMS, hosting panel, domain registrar and DNS.
Name one person responsible for updates, with a monthly slot in the calendar.
Set up off-site backups and actually restore one to confirm it works.
Delete unused plugins, themes and user accounts, including ex-staff and former agencies.
Check indexed pages in Search Console monthly for URLs you did not create.

Two questions for your web supplier

Who applies updates, and how often?: Get the answer in writing, including plugins and themes, not only CMS core. "The host handles it" usually means only the server operating system.
Where are backups stored, and when was a restore last tested?: Backups on the same server as the site are lost with the site. An untested backup is an assumption, not a control.

What does a compromise actually cost a small business?

The direct cost is remediation time. The larger costs are the search-visibility loss while spam URLs are cleared, customers seeing a browser warning on your domain, and — if the same passwords protect email or the registrar — losing control of the domain itself. That last scenario is the one worth spending an hour on today.

If you take one action from this page, enable multi-factor authentication on your domain registrar account.

Where should a small business start?

STEP 01
Secure the accounts that can change the site
Enforce MFA on the CMS, hosting panel, domain registrar and the email account used for password resets. The registrar and email account are the highest-impact of the four and the most commonly forgotten.
STEP 02
Reduce what can be attacked
Delete unused plugins, themes, integrations and old staging copies. Unused code is patched last and exploited first.
STEP 03
Make updates routine, not heroic
Enable automatic updates for the platform and extensions, with a weekly check that they actually applied.
STEP 04
Prove your backups restore
An untested backup is an assumption. Restore into a staging environment once and note how long it took.
STEP 05
Turn on the free early-warning signals
Verify the site in Google Search Console and read the Security Issues and Pages reports. This is usually where a compromise shows up first.

What can you skip when the budget is small?

Do first	Why	Can wait
MFA on administrative and registrar accounts	Removes the single most common entry route: credential reuse	Enterprise identity platforms
Platform and extension updates	Closes the vulnerabilities actually being exploited at scale	Continuous vulnerability scanning subscriptions
Least-privilege CMS roles	An editor account cannot install a backdoor	Formal access review tooling
Verified, tested backups	Turns a compromise into an inconvenience	Hot standby infrastructure
Search Console monitoring	Free detection of hacked content and spam	Paid monitoring services

The ordering matters more than the spend. Most small-business site compromises trace back to a reused administrator password or an out-of-date extension, both of which are addressed by the first three rows at no cost beyond attention.

Common mistakes small businesses make

Sharing one administrator login across the owner, a freelancer and an agency, which makes attribution impossible after an incident.
Leaving a former contractor's account and API tokens active long after the engagement ends.
Treating a security plugin as a substitute for updates: a plugin cannot patch the vulnerability it is monitoring.
Storing the only backup on the same server as the site.
Assuming a small site is not a target. Most injections are opportunistic and automated, selected by platform and version rather than by audience size.
Cleaning visible spam without finding the entry point, which produces a repeat incident within days.

Frequently asked questions

Why would anyone attack a small business website?: They usually are not attacking you specifically. Automated tools scan for known vulnerable components, and any site that matches is used for spam hosting, link injection or malware distribution.
Is managed hosting enough?: Managed hosting usually covers the server and sometimes CMS core, but rarely your plugins, themes, user accounts or content. Confirm the boundary in writing.

Sources

Cyber Essentials — CISASupports: Baseline controls for organisations without security teams.