Website security checklist for small businesses: 15 steps to avoid getting hacked

The 15-step checklist

• Keep your CMS, plugins, themes and frameworks updated.
• Delete plugins, themes and test pages you no longer use.
• Use a password manager and unique, long passwords for every account.
• Turn on two-factor authentication for hosting, domain, email and admin panels.
• Give each team member their own login, with only the access they need.
• Remove accounts of people who have left.
• Serve the whole site over HTTPS and redirect HTTP to HTTPS.
• Add security headers (Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options).
• Protect forms with validation, rate limiting and spam protection.
• Never store secret keys (payment, API, database) in website front-end code.
• Block public access to configuration files, backups and logs.
• Take automatic daily backups stored away from the server — and test restoring one.
• Set up uptime monitoring and Google Search Console security alerts.
• Keep the server’s software (PHP, Node.js, database) on supported versions.
• Write down who to call and what to do if something goes wrong.

Signs your site may be compromised

• Google shows a “This site may be hacked” warning.
• Strange pages, links or redirects appear, often in other languages.
• Your host suspends the account for sending spam.
• Admin users you did not create.
• Search Console reports security issues.

If you are hacked

• Take the site offline or into maintenance mode.
• Change every password and revoke API keys.
• Restore a clean backup from before the attack.
• Update everything and remove the weakness that was exploited.
• Request a review in Google Search Console once the site is clean.

Security is a habit, not a product

No tool makes a website “hack-proof”. A short monthly routine — updates, a backup check and a review of user accounts — protects you far more than any single plugin.