Most small business websites aren’t hacked by someone targeting them personally. They’re hit by automated bots that scan millions of sites for weak passwords, outdated plugins and forgotten admin accounts. If your site has one of those gaps, it will eventually be found.
Zero trust sounds like an enterprise buzzword, but the idea is simple: don’t assume any login, device or connection is safe just because it was safe yesterday. Verify every time, and give every account only the access it needs.
1. Require multi-factor authentication on every login
Stolen and reused passwords are the most common way into a website. Multi-factor authentication (a code from an app or a security key) stops most of those attacks cold. Turn it on for your website admin, your hosting account, your domain registrar and your email.
2. Give people only the access they need
That marketing intern from three summers ago shouldn’t still be an administrator. Review your user list, remove old accounts, and give each person the lowest role that lets them do their job. Editors don’t need to install plugins.
3. Keep everything updated, and remove what you don’t use
Outdated plugins and themes are behind a large share of hacked WordPress sites. Update core software, themes and plugins promptly, and delete anything that’s deactivated. Unused code is still attackable code.
4. Put a firewall in front of your site
A web application firewall filters malicious traffic before it reaches your site, blocking common attacks and login floods. Many good hosts include one, or you can add one through a service like Cloudflare.
5. Back up, and prove the backups work
Keep automatic daily backups stored somewhere other than your web server, and keep several weeks of history. Then actually test a restore. A backup you’ve never restored is a guess.
Don’t forget the basics
- HTTPS on every page, with automatic renewal.
- Unique, long passwords stored in a password manager.
- Uptime and file-change monitoring so you hear about problems before customers do.
New York’s SHIELD Act also requires businesses that hold New York residents’ private information to maintain reasonable security safeguards. If your site collects customer data, these steps are a big part of meeting that bar.
Want help locking down your site? See our website security services.
Founder and lead developer of DigitalRocket in Syracuse. Jon has spent more than 20 years building websites and software, including over a decade at Syracuse advertising agencies, and now helps Central New York businesses put AI to work, connect their tools with custom software, and run fast, secure websites.