Cybersecurity Basics for Small Websites

Attackers rarely target a small website personally. They run automated scans for known weaknesses. That means a handful of basic controls block most real-world attacks.

Secure the accounts first

Use a unique, long password and turn on two-factor authentication for your hosting, domain registrar, DNS provider and site admin. Your domain registrar account is especially important: whoever controls it controls your site. Read more in Protecting Your Online Accounts.

Keep software updated

Update your CMS, plugins, themes and server packages promptly. Remove plugins you no longer use; unused code is still attack surface.

Use HTTPS everywhere

Serve every page over HTTPS and redirect plain HTTP. Many hosts and CDNs provide free certificates.

Back up, and test the restore

A backup you have never restored is a hope, not a plan. Keep copies off the hosting account and practice restoring them.

Limit who can do what

Give each person their own login with the least privilege they need. Remove access when people leave.

Watch for warning signs

Unexpected admin users, new files you did not upload, or traffic spikes to odd URLs deserve investigation. US small businesses can find free guidance from the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Trade Commission's small business cybersecurity resources, and can report incidents to the FBI's Internet Crime Complaint Center (IC3).

For performance-related hardening such as caching and CDNs, see Website Performance Optimization Fundamentals.

Start with an inventory

You cannot protect what you do not know you have. Write down every piece of your website's infrastructure: the domain registrar, the DNS provider, the hosting or platform account, the content management system, plugins or themes, email service, analytics and any payment or form tools. Note who has access to each one and whether two-factor authentication is turned on. This one-page list becomes your security checklist and your recovery plan.

Lock down the domain

Your domain name is the foundation everything else depends on. If someone takes over your registrar account, they can point your site and email anywhere. Turn on two-factor authentication at the registrar, enable registrar lock (sometimes called transfer lock) so the domain cannot be moved without extra steps, and make sure the contact email on the account is one you actively monitor. Set the domain to renew automatically and keep the payment card up to date; expired domains are a surprisingly common cause of outages.

Keep software updated, and remove what you do not use

Most website compromises exploit known vulnerabilities that already have fixes. If you run a content management system such as WordPress, enable automatic updates for minor and security releases, and update plugins and themes promptly. Delete plugins and themes you are not using rather than just deactivating them, because inactive code can still be exploited. Prefer well-maintained extensions with recent updates and a clear publisher.

The Cybersecurity and Infrastructure Security Agency (CISA) maintains a public Known Exploited Vulnerabilities catalog. You do not need to read it daily, but it is a useful reminder that attackers actively use published flaws, which is why prompt patching matters.

Use strong authentication everywhere

Every account that can change your site should have a unique, long password stored in a password manager, plus two-factor authentication. Where available, choose an authenticator app or a hardware security key over text-message codes. Give each person their own login instead of sharing one admin account, and grant the lowest level of access that lets them do their job. When a contractor's project ends, remove their access the same day.

Back up, and test the restore

A backup you have never restored is a hope, not a plan. Keep automated backups of both your files and your database, store at least one copy separately from your hosting account, and keep several days or weeks of history so you can roll back to a point before a problem started. A few times a year, practice restoring to a test location and time how long it takes. That number tells you how long your site could be down after an incident.

Put a web application firewall and HTTPS in front

Serve your entire site over HTTPS and redirect plain HTTP to it. Many hosting providers and content delivery networks, including Cloudflare, offer free TLS certificates and basic firewall rules that block common automated attacks and abusive bots. Rate limiting on login pages and forms reduces password-guessing attempts and spam.

Protect forms and user data

Contact forms, newsletter sign-ups and comment sections are frequent targets for spam and abuse. Use a CAPTCHA or a privacy-friendly challenge such as Cloudflare Turnstile, validate input on the server, and collect only the information you truly need. If you store personal information about US residents, check which state privacy laws may apply to you; California's CCPA/CPRA is the best known, but several other states have passed comprehensive privacy laws with different thresholds. Many small sites fall below those thresholds, but keeping data collection minimal is good practice regardless.

Watch for warning signs

Set up simple monitoring so problems reach you quickly:

• An uptime monitor that emails you when the site goes down.
• Google Search Console, which can alert you if Google detects malware or hacked content on your site.
• Login alerts from your hosting and CMS accounts.
• Regular review of admin user lists for accounts you do not recognize.

Unexpected redirects, new admin users, unfamiliar files, spam pages appearing in search results or sudden drops in traffic are all signs worth investigating immediately.

Have a short incident plan

Write down, in advance, what you will do if the site is compromised: who to contact at your host, how to take the site offline or into maintenance mode, where the clean backups are, and which passwords to rotate first (registrar, hosting, CMS admins, email). After restoring, find and fix the original weakness, or the attacker may simply return. If customer data may have been exposed, consult your state's breach notification rules or a lawyer; every US state has a data breach notification law, and the requirements differ.

The bottom line

Small websites rarely get hacked because someone targeted them personally. They get caught by automated scans looking for outdated software and weak logins. Unique passwords with two-factor authentication, prompt updates, tested backups and basic monitoring stop the large majority of those attempts and make recovery fast when something does go wrong.