Basic web security: HTTPS, backups and passwords

Three measures prevent the large majority of small business website disasters: HTTPS on every page, backups that you have actually restored once, and passwords that are long, unique and stored in a manager. None of this requires a security consultant. Small businesses are not hacked by masterminds; they are hacked by bots scanning the whole internet for the same five open doors, and this article is about closing them.

HTTPS: the padlock is the minimum

HTTPS encrypts traffic between your visitor and your site. Without it, browsers brand your site “Not secure” next to your own name, Google ranks you lower, and anything typed into your forms travels readable. Certificates have been free for years, so any site still on HTTP in 2026 is a sign of neglect, not cost.

Check yours: the padlock must appear on every page, and the http:// version must redirect to https:// automatically. Half-migrated sites, secure on the home page and broken on the contact form, are common and fully count as broken. Every site I deliver ships HTTPS-complete by default.

Backups: you have one when you have restored one

A backup you have never restored is a wish. Real backup practice is three questions: does a copy of the site and its data get made automatically (never by a human remembering)? does it live somewhere other than the site’s own server (a server that dies takes its own backups with it)? and has someone restored one, at least once, to prove the chain works? The restore test finds broken backups while the site is still alive, which is the only cheap time to find them.

For a static presence site, backups are simple. For anything with a database (bookings, clients, sales), they are the difference between a bad afternoon and losing the business records. This is a core piece of what maintenance covers after launch.

Passwords: the manager is the whole trick

The realistic threat is not guessing; it is reuse. Sites get breached, leaked email-password pairs get tried everywhere, and if your hosting password is also your pizza-app password, the bots get in politely, with credentials. The fix is mechanical: a password manager generating long unique passwords for hosting, domain, email and admin panels, plus two-factor authentication on the accounts that matter (registrar and email above all, because whoever holds your email can reset everything else).

Shared access deserves one sentence: when someone leaves the team or a provider changes, their access gets revoked that day. Old credentials that still work are the door nobody watches. This is also why accounts must be in your name: you cannot revoke what you do not control.

Software updates, the fourth habit

Everything a site runs on publishes security patches, and the bots specifically hunt sites that have not applied them. If your site is on a platform, updates are the platform’s job; if it is yours, they are someone’s job, explicitly. On my projects that someone is me, under the USD 30 to 60 monthly maintenance, which exists mostly so these four habits happen without you thinking about them.

Frequently asked questions

My site is small. Who would bother attacking it?

Nobody, and it does not matter: bots attack addresses, not businesses. They want your server for spam, your visitors for scams, your forms for phishing. Small sites are targeted precisely because they are the least defended.

What does HTTPS cost?

Nothing. Certificates are free and renew automatically on any decent hosting. If someone charges you meaningfully for “an SSL certificate”, question the rest of the invoice too.

How often should backups run?

Daily for anything with a database, and before any significant change. Static sites can be looser. Retention matters too: keeping several weeks of copies protects you when a problem is discovered late.

Is this enough for a site that takes payments?

It is the floor, and payments raise the bar. The good news: using Stripe or PayPal correctly means card data never touches your server, which removes the scariest class of risk from your side.

Want your site to pass this checklist without you running it? Message me on WhatsApp and you will have a fixed price and a delivery date in writing within 48 hours.