Website Security Basics Every Small Business Should Know

Small businesses often assume hackers only go after big companies. In reality, small businesses are frequent targets precisely because they are easier: weak passwords, no backups, nobody watching. The good news is that a handful of habits block the vast majority of attacks.

1. Use HTTPS everywhere

An SSL certificate encrypts the connection between your visitors and your website, and puts the padlock in the address bar. Without it, browsers show a "Not secure" warning — enough to send most customers away — and anything typed into a form can be intercepted. Most modern website builders include SSL for free; make sure it's switched on for your custom domain as well.

2. Strong, unique passwords

• Use a different password for every account — website, email, bank, social media.
• Make them long: a phrase of four or more random words is stronger than a short jumble.
• Use a password manager so you don't have to remember them.
• Never share one login between staff. Give each person their own account.

3. Turn on two-factor authentication

Two-factor authentication (2FA) asks for a second proof — a code from an app or a text message — when someone logs in. Even if your password leaks, an attacker can't get in without your phone. Turn it on for, at minimum:

• Your email account (the key to resetting everything else)
• Your website admin
• Your domain registrar
• Payment and banking accounts
• Social media accounts

4. Give staff only what they need

Use roles and permissions. Someone who writes blog posts doesn't need access to payments or settings. When a staff member leaves, remove their access the same day.

5. Keep backups

If something goes wrong — a mistake, a hack, a broken update — a recent backup turns a disaster into an inconvenience. Check that your platform backs up your site automatically, and keep your own copies of important things: product lists, customer lists, images and documents.

6. Keep software up to date

On self-hosted platforms, outdated plugins and themes are the most common way websites get hacked. Update regularly and delete anything you don't use. Hosted builders handle updates for you, which is one of their biggest security advantages.

7. Handle payments safely

• Never store customers' card numbers yourself.
• Use an established payment provider — they handle card security for you.
• Never ask customers to send card details by email or chat.

8. Recognise phishing

Most breaches start with a convincing email. Warning signs:

When in doubt, don't click — open the website yourself or phone the company on a number you already know.

9. Protect your forms from spam

Contact and sign-up forms attract bots. Spam protection keeps your inbox usable and stops your forms being used to send junk.

10. Respect customer data

Collect only the data you need, explain how you use it in a privacy policy, and keep it in secure systems rather than spreadsheets emailed around.

A ten-minute security checklist

• ☐ Padlock showing on every page of my site
• ☐ 2FA on email, website, domain and payments
• ☐ No shared logins
• ☐ Ex-staff access removed
• ☐ I know where my backups are
• ☐ Payment handled by a trusted provider

Every Volnyn site includes free SSL, team roles and permissions, and secure hosted payments, with updates handled for you. Start free at volnyn.com.