An installation company called us on a Tuesday morning last year. Their website had suddenly started showing an ad for a gambling site, somewhere at the bottom of the contact page. No movie-style hack, no ransom demand, no drama. Just a plugin that hadn't been updated in two years.
Stories like that are the rule rather than the exception. Small businesses are rarely targeted deliberately. They get found by automated scripts that comb the entire internet looking for outdated software. Your website usually isn't a target — it's an open door that something happened to walk past.
The good news: you don't need an IT department for this. Website security for a hair salon, a dental practice or a restaurant comes down to five things you keep in order. Here they are, in the order they usually go wrong.
1 What security actually means for your site
When business owners hear "security", they think of hackers and stolen data. For a local website the risk is far more practical. The damage almost always shows up in these four ways:
- Your site is down at the exact moment a customer looks for you
- Google flags your site as unsafe, so visitors see a warning first
- You lose copy, photos or form submissions with no recent copy to fall back on
- Your reputation takes a hit because there's junk sitting on your domain
That's not an abstract cyber risk. That's a week without enquiries, plus an invoice from a developer who has to clean up the mess. Prevention here is literally ten times cheaper than repair.
2 SSL is the minimum, not an achievement
The padlock in the address bar (the https certificate) is standard by now. Every serious host provides it for free. Without it, browsers show an explicit warning on a contact form — which is precisely the moment you lose an enquiry.
Assuming you're done the moment the padlock appears. SSL only encrypts the traffic between visitor and server. It says nothing about outdated plugins, weak passwords or missing backups — the things that actually cause trouble.
Also check that your site genuinely redirects to https. We regularly see websites where both versions exist side by side. That confuses visitors and splits your SEO value across two addresses.
3 Overdue maintenance is the real hole
Almost every hacked small-business website we come across was entered through outdated software. A theme, a plugin, a form module. Someone publishes a vulnerability, scripts scan for it worldwide, and a site that hasn't been updated in three months floats to the surface.
The fix isn't a big project — it's a rhythm. Here's what a realistic maintenance schedule looks like for a small business:
- Monthly: apply updates to your CMS, theme and plugins — back up first, then update.
- After every update: check the homepage, the contact form and one service page on your phone.
- Every quarter: delete plugins you don't use entirely, not just deactivate them.
- Twice a year: check whether everything you rely on is still actively maintained by its maker.
- Ongoing: send update notifications to an email address you actually read.
Fifteen minutes a month covers this for most small sites. If you don't have the time or the appetite, make it part of a maintenance agreement with your agency. What you shouldn't do is skip it because the site "works fine".
4 Backups: your only real safety net
Of everything on this list, this matters most. Every other measure reduces the chance that something happens. A backup decides how bad it is when something does: half a day of inconvenience, or weeks of work gone.
A usable backup meets four conditions:
- Automatic. Manual backups get forgotten precisely during your busiest weeks.
- Stored off your own server. A copy on the same server disappears along with the problem.
- Recent enough. Ask yourself how many days of work you could lose without real pain. That's your frequency.
- Tested. Restore a backup once to a staging environment. A backup you've never restored is an assumption.
Almost every business skips that last point. And that's exactly where it gets painful, because you normally discover a corrupted backup at the worst possible moment.
Not sure whether your site is set up properly?
We check the SSL, updates, backups and hosting of your website and tell you in plain language what is and isn't in order.
5 Your hosting decides more than you'd think
Cheap hosting at two euros a month is rarely a bargain. You're sharing a server with hundreds of other sites, server software updates lag behind, and support consists of a form you wait days on.
What to look for in good hosting isn't complicated: recent PHP versions, automatic daily backups, free SSL, a firewall at server level and reachable support in your own language. For a small business site that usually costs between ten and thirty euros a month — the difference between "one phone call" and days offline.
6 The human side: access and passwords
Technology is rarely the weakest point. People are. The intern who left three years ago and still has admin rights. The password Salon2023! that's also used on five other services. The login details sitting in a WhatsApp group.
- Give everyone only the rights their role needs — administrator is for administrators
- Remove accounts for people who no longer work with you, that same week
- Turn on two-factor authentication for your CMS, your hosting and your domain registrar
- Keep passwords in a password manager, not in your inbox
- Make sure you own your domain and hosting yourself, not your previous builder
That last one isn't a security detail, it's a business risk. If you can't get into your own domain, you can't act when something goes wrong — no matter how well the rest is arranged.
Conclusion
Website security for a small business isn't a technical specialism. It's maintenance: a valid certificate, monthly updates, a tested backup stored off your server, hosting that does its job, and access that's kept tidy.
Block out half an hour once and you'll have covered most of it. Do nothing, and it isn't a question of whether but when you find out — usually at the moment a customer actually needs your website.