Website Security for Small Business: A Plain-English 2026 How-To

Security sounds like something for banks and IT departments. For a small business, it's mostly a trust problem with a technical cause.

Think about what a compromised site does to your enquiries. A visitor arrives from Google and gets a full-screen browser warning telling them the site may be dangerous. Or your search listing quietly gains a note saying the site may have been hacked. Or someone injects hundreds of spam pages under your domain, and your rankings slide while the phone goes quiet.

A hijacked contact form starts sending spam through your server, your domain lands on an email blocklist, and your quotes begin landing in customers' junk folders. The enquiries just thin out.

A hacked website is a salesperson who has started handing out someone else's business cards.

If your site collects personal information, there's a legal angle too. Under New Zealand's Privacy Act 2020, businesses must notify the Privacy Commissioner and affected people when a privacy breach is likely to cause serious harm.

Real small business hacking is boring. A script tries common passwords against your login page at 3am, or scans for a plugin with a known hole, and walks straight in.

The OWASP Top 10, the most widely referenced list of web application security risks, keeps returning to the same themes: broken access control, security misconfiguration, and outdated or untrusted components. For a typical small business site, those translate into a short, very fixable list.

• Weak or reused passwords. If your website password is also your email password from a breached service, bots will find it.
• Outdated plugins, themes and core software. Known vulnerabilities get published, and bots go looking for sites that haven't patched them.
• Too many people with admin rights. Old staff, old agencies, the nephew who "helped with the site" in 2021.
• Abandoned add-ons. A plugin whose developer stopped maintaining it is a lock nobody is servicing anymore.
• Phished accounts. A fake "your domain is expiring" email that harvests your registrar login can cost you your domain and your email in one go.

That last one deserves extra attention. Whoever controls your domain controls your website and your business email. Many owners can't even remember which account it sits in.

Most break-ins on small sites start at the login screen, so this is the highest-value hour you'll spend on security. Do it for every account that touches your website, not just the CMS.

The ex-employee who still has admin access is rarely a criminal mastermind. More often they're a door you forgot to close, and their old password may be sitting in a breached database somewhere.

While you're in there, confirm the domain and hosting sit in your business's name and account.

Every update notice you dismiss is a small bet that nobody will exploit the hole it fixes. Bots are very good at collecting on that bet.

How much work this involves depends on your platform. Hosted builders like Squarespace, Wix, Webflow and Shopify manage the core software and servers for you, so your job is mostly logins and third-party apps. Self-hosted WordPress gives you more control and more responsibility, because the core, theme and every plugin need regular updates. Neither is automatically safer. Our comparison of Wix vs Squarespace vs WordPress covers that trade-off in more detail.

A practical update routine for a WordPress site looks like this:

1. Take a fresh backup before updating anything.
2. Update plugins, theme and core at least weekly, or switch on automatic updates for minor releases.
3. Delete plugins and themes you aren't using. Deactivated still means installed.
4. Check each plugin's last update date. If it hasn't been touched in over a year, look for a maintained alternative.
5. Test big updates on a staging copy first if your site takes bookings or payments.

Fewer moving parts means fewer things to patch. A lean site with eight well-chosen plugins is far easier to keep secure than one held together with forty.

HTTPS encrypts the connection between your visitor and your website, so form entries and logins can't be read in transit. Modern browsers label plain HTTP pages as "Not secure", which is roughly the last thing you want next to your quote form.

The certificate itself is usually free. Most decent hosts and every major builder provide one automatically through services like Let's Encrypt. The mistakes tend to happen around it.

• Make sure every HTTP address redirects to the HTTPS version, including the www and non-www variants.
• Fix "mixed content", where a secure page still loads an image or script over HTTP.
• Confirm the certificate renews automatically, so it doesn't expire on a long weekend.

One honest clarification: HTTPS protects data on its way to your site. It does nothing if your admin password is "Summer2024". The padlock means the connection is private, not that the site is unhackable. Our website launch checklist includes the HTTPS and redirect checks worth running on any new or rebuilt site.

Backups are the difference between a bad afternoon and a bad month. When something breaks, a clean backup lets you roll back and carry on instead of rebuilding from memory.

A backup you've never restored is a rumour. Plenty of owners discover theirs were empty, partial, or stored on the infected server, which is like keeping the spare key inside the house.

Your contact form is the most valuable thing on the site and one of the most abused. Bots love open forms because they can stuff them with spam links or use them to relay junk mail.

• Add spam protection. A hidden honeypot field, Cloudflare Turnstile or Google reCAPTCHA will stop most automated submissions without annoying real people.
• Only ask for what you need. A quote form rarely needs a date of birth.
• Keep sensitive details off email. Health information, ID documents and payment details belong in a proper secure system, not a plain notification email.
• Set up SPF, DKIM and DMARC. These email records make it much harder for someone to send fake emails pretending to be your domain, and they help your genuine replies reach inboxes.

Then test the form monthly. Security is pointless if the form quietly stopped delivering in March. For layout ideas that keep forms short and trustworthy, see our contact page examples.

Cheap hosting can be fine, but you want to know whether the locks work and whether anyone answers when the alarm goes off.

Rock-bottom shared hosting often skips some of these, or sells them back as add-ons. Managed hosting usually bundles them, which is part of why it costs more. Our guide to website hosting costs breaks down what each tier typically includes and where renewal prices jump.

The worst way to discover a hack is from a customer. Basic monitoring costs little and buys you early warning.

• Google Search Console. It's free, and its Security Issues report will alert you if Google detects hacked content or malware on your site. If you haven't set it up, our guide to fixing Google indexing problems walks through the basics.
• Uptime monitoring. Free and low-cost tools email or text you when the site goes down.
• Security alerts. On WordPress, a reputable security plugin can flag changed files, new admin users and repeated failed logins.
• A monthly human check. Open the site on your phone, submit the form, and search Google for site:yourdomain.com to spot pages you didn't create.

Good security for a small site is mostly habits, not expensive software. Here are typical NZD ranges. Actual prices vary by platform, provider and how much you do yourself.

Security is boring right up until it becomes expensive. The cheapest version is always the one you do before anything goes wrong.

A care plan makes sense if you don't want to think about updates at all. If you're comparing plans, our breakdown of website maintenance costs shows what should sit inside one and which fees to question.

These usually come from being busy, not careless. They're still worth fixing.

• "We're too small to be a target." Bots don't check your revenue first. They check your plugin versions.
• One shared admin login. Convenient until someone leaves on bad terms.
• Installing a security plugin and never configuring it. A smoke alarm still in its packaging.
• Backups on the same server. When the server goes, so does the safety net.
• Leaving the domain in an old agency's account. You don't fully own a website if someone else holds the master key.
• Patching a site that should be retired. An old build on an abandoned theme can cost more to keep safe than to replace.

That last point is a judgement call. If your site needs constant fixes, runs on unsupported software, and isn't bringing in enquiries anyway, a rebuild may be the more sensible spend. Our guide to website redesign cost and timeline helps you weigh it up honestly.

First, breathe. A hacked site is fixable, and acting in the right order matters more than acting fast and randomly.

1. Don't start deleting things. You may destroy evidence of how they got in, which makes it more likely to happen again.
2. Change passwords from a clean device. Website admin, hosting, domain registrar, email and any connected accounts, with two-factor authentication switched on.
3. Contact your host. Many can isolate the site, scan for malware, or restore a backup.
4. Restore or clean. Roll back to a clean backup from before the hack, then update everything immediately. If no clean backup exists, get a professional cleanup.
5. Check for back doors. Look for admin users you didn't create and files you don't recognise.
6. Tell Google it's fixed. If Search Console shows a security issue, request a review once the site is clean so warnings can be removed.
7. Assess privacy obligations. If customer data may have been exposed, consider whether the Privacy Act requires you to notify the Privacy Commissioner and affected people.
8. Report it. New Zealand's National Cyber Security Centre supports small businesses through its Own Your Online guidance and accepts incident reports.

Once things are stable, work out how they got in. Otherwise you've only tidied the room the burglar will visit again.

We're a web design studio, not a cybersecurity firm, and we'd rather say that plainly. What we can do is build sites that start secure by design: lean, well-structured, easy to maintain, and handed over with the keys firmly in your pocket.

For sites handling payments or sensitive records, we lean on established platforms built for that job rather than reinventing it. If you want to know where your current site stands, request a free website audit and we'll flag the obvious risks alongside the conversion fixes. Or compare our website packages and what each includes.

Website security for small business has very little to do with fortress-level defences. The real goal is to avoid being the easiest door on the street. Unique logins with two-factor, regular updates, HTTPS, tested backups, protected forms, sensible hosting and a little monitoring will put you ahead of most of the sites bots go looking for.

Do the access checklist this week. Confirm you own your domain. Test a backup. Then get back to running the business, with a website that earns trust instead of quietly losing it.

If you'd like a second pair of eyes first, start with a free audit.