Website security for business owners: HTTPS, updates, backups and access

A small business website may not look like an attractive target, but attacks are largely automated: bots indiscriminately search for outdated software, weak passwords and open doors. You do not need to be a security expert to remove most of the risk. A handful of basic measures, applied consistently, do most of the work. This article walks through them.

1. HTTPS everywhere

HTTPS encrypts the traffic between the visitor and your website. According to web.dev it protects three things: confidentiality (nobody on the way can read along), integrity (nobody can add or change anything on the page unnoticed) and authenticity (the visitor knows they are talking to your site). A certificate is free with many hosting providers and renews automatically. Then check three things:

• All HTTP addresses redirect permanently to HTTPS.
• There is no “mixed content”: pages that load over HTTPS but still pull in images or scripts over HTTP. MDN explains that browsers may block such content or show a warning.
• The certificate does not expire unnoticed. Turn on a reminder or automatic renewal.

HTTPS is also a basic precondition when processing forms and personal data: Article 32 of the GDPR asks for appropriate technical measures to secure personal data.

2. Keep software up to date

The most common cause of hacked websites is outdated software: the CMS, a theme, a plugin. Vulnerabilities become public and bots test within a short time whether your site still has them. What helps:

1. Make an inventory of all components: CMS, theme, plugins, server, PHP or Node version.
2. Update regularly, and apply security updates as soon as possible.
3. Test updates preferably on a copy of the site first.
4. Remove what you do not use. A deactivated plugin that stays installed is still code that can be vulnerable.
5. Choose plugins deliberately: is it maintained, how recent is the latest update?

A website without a database or CMS, served as static files, has less risk here because less software is running. That is one reason we like building light, custom sites at CUBO Agency.

3. Backups you can actually restore

A backup you have never tested is a hope. Arrange:

• Automatic and regular. How often depends on how often your site changes: a web shop with orders needs it more often than a brochure site.
• In a different place than the server itself. If the backup is on the same machine, it disappears together with the site in a failure or attack.
• Multiple versions. An infection can go unnoticed for weeks; then you want to go back to an earlier version.
• Testing. Restore the backup to a test environment at least once a year to see that it works and how long it takes.
• Knowing who does what. Record who performs the restore and what your hosting provider does and does not do.

4. Strong access

Stolen or easy-to-guess passwords are a common route in. Measures:

• A unique, long password per account, preferably through a password manager.
• Two-factor authentication (2FA) on CMS, hosting, domain registration and email. The domain and email matter more than you think: whoever takes over your email can reset passwords.
• No shared accounts. Give everyone their own login and revoke rights when someone leaves.
• Minimal rights. Not everyone needs to be an administrator.
• No default usernames such as “admin”.

5. Reduce the attack surface

• Forms: use server-side validation and a spam filter. Do not store more than necessary.
• File uploads: only allow what you really need, and check type and size.
• Admin area: restrict access where possible, for example by IP address, and disable unnecessary features.
• Error messages: do not show visitors technical details.
• External scripts: every external script you load is someone else's code on your page. Use few, and only from reliable sources.

6. Know what you are protecting against

OWASP, an international non-profit, publishes the OWASP Top Ten, an overview of the most critical security risks for web applications, such as broken access control and injection. As a business owner you do not need to be able to exploit them, but it is a good list to put to a developer or hosting provider: how do you address these risks? A good answer is concrete.

7. Prepare for an incident

Even with good measures, something can go wrong. Record in advance:

1. Who you call: hosting provider, developer, and who decides on your side.
2. How you restore: the steps and the time it takes.
3. What you report. If personal data has leaked, Article 33 of the GDPR in many cases imposes an obligation to notify the Dutch Data Protection Authority within 72 hours after you become aware of the breach. Check your situation, since not every incident falls under this.
4. How you inform customers, if necessary.

The Dutch National Cyber Security Centre (NCSC) publishes information and advice for organisations about digital safety on its website; it is a good starting point if you want to know more.

A simple monthly routine

• Check and apply updates.
• Check that backups were made and that the most recent one is not empty.
• Review user accounts and remove old ones.
• Certificate and domain: check expiry dates.
• A short visit to your own site on desktop and mobile: does the form work, do all pages load?

In conclusion

Security is not a product but a habit. At CUBO Agency we provide hosting and maintenance with updates, backups and monitoring, so you can focus on your business. Want to know how secure your current site is? Book a free intro call. See also cookies and GDPR.

Sources

Reviewed on 28 October 2026 against the sources below. Rules and guidelines change; this article is general information, not legal or tax advice.

• Why HTTPS matters (web.dev)
• Mixed content (MDN Web Docs)
• OWASP Top Ten (OWASP Foundation)
• Nationaal Cyber Security Centrum (NCSC)
• Verordening (EU) 2016/679, Algemene verordening gegevensbescherming, artikel 32 en 33 (EUR-Lex)

Book an intro call