PART 2 OF 2 | Website Security for Small Businesses
Last week, we talked about why website security can no longer sit at the bottom of your to-do list.
AI is helping attackers find weaknesses faster. But knowing there's a risk is only half the battle. You also need to know what to check, who's responsible, and what to do when something needs attention.
Every website has weak spots. The trick is knowing where to look before someone else does. In Part 2, we’ll cover the first steps to tighten security and give your website a stronger defense.
Know What's Running Your Website
Your website has more going on behind the scenes than you might realize. The platform, plugins, server, and connected applications all play a role in keeping it running.
The October 2026 PHP vulnerabilities are a good example. These put 70% of websites at risk of any cyberattack since these flaws can let attackers run malicious code without logging in, making an attack harder to spot. That is why website security matters. And the other 30%? Their risk depends on the technology and security they have.
You might be using PHP without ever having installed it yourself.
Here's what to do:
WordPress: Check for updates to WordPress, your plugins, and your themes. Confirm who handles server-level updates and backups.
Squarespace, Wix, or another hosted platform: The provider manages much of the underlying infrastructure, but you still need to secure your account, review access, and follow relevant security notices.
Managed hosting: Ask your provider which updates and backups it handles and what remains your responsibility.
Don't assume that updating WordPress also updates PHP. They're separate parts of your website's technology.
If you're unsure if your system is affected by a security vulnerability, ask your hosting provider or IT professional to check. Don't change server settings you don't understand.
You need to know what you're running and who's responsible for maintaining it. And if you need a hand, we can handle your tech.
Lock Down Your Accounts
A website can have the latest updates and still be compromised if someone gets into the wrong account.
Start with your website administrator, hosting account, domain registrar, business email, and payment accounts.
Use a unique password for each service and change it every 3 months. A password manager can help you keep track of them without reusing the same password everywhere.
Next, turn on multifactor authentication (MFA). It adds another step to verify your identity when you sign in. Use it wherever available, especially for accounts that control your website or can reset other passwords.
Finally, review who has access. Remove former employees and contractors who no longer need it, and investigate unfamiliar accounts.
Your business email deserves special attention. If someone takes it over, they may be able to reset passwords for other services.
And never give a verification code to someone who contacts you unexpectedly claiming to be your website provider. Verify the request independently.
Check Your Money and Your Backups
Website security isn't just about whether your homepage looks normal.
If you accept payments online, review your bank statements, payment processor activity, and website sales. Look for unfamiliar transactions or unexpected changes to payment instructions.
If something looks suspicious, contact your bank or payment provider through its official app or the number on your statement.
Now, about those backups.
A backup is a separate copy of your website and its important data that can help you recover if something goes wrong. But a backup isn't useful just because somebody says one exists.
Ask whoever manages your website when the last successful backup was made, what it includes, and whether it can actually be restored.
If your website disappeared tomorrow, who would bring it back?
You should know the answer before you need it. Do not wait for a digital disaster to find out who’s got your back.
Know What to Do When Something Looks Wrong
Unexpected administrator accounts. Website changes you didn't authorize. Strange redirects. Security alerts you can't explain.
Don't ignore them.
Contact your hosting provider and a qualified IT or security professional. Preserve relevant alerts and logs where possible, and don't assume the problem is solved just because your homepage looks normal again.
If customer information may have been exposed, you may also have reporting or notification obligations.
And be careful with unsolicited offers to fix your website. Scammers know that fear makes people move quickly. Don't hand over your credentials or payment information just because someone claims you're under attack.
If you suspect a breach, don’t go it alone.
Hennepin County Is Giving A Hand To Small Business Owners
You have a business to run. You shouldn't have to become your own IT department just to figure out what needs attention.
If your business is in Hennepin County, Minnesota, you may qualify for IT consulting and cybersecurity support through Elevate Hennepin.
Technologist Computers is an Elevate Hennepin business advisor. Eligible businesses can access consulting services at no cost, subject to program requirements and the scope of the work.
You run the business. We'll help you make sense of the technology.
Keep Your Business In Good Shape
You don't have to be a know-it-all to protect your business. But you do need to know what's running behind the scenes, who's keeping it secure, and what happens when something goes wrong.
Hope for the best. Patch for the worst. Have a plan to bounce back.
Your website is working for your business so make sure you're doing your part to protect it.
Not sure where to start?
