A small business website can be hacked or flagged as unsafe for reasons that have nothing to do with how important the business is. Automated attacks look for out-of-date software and weak passwords, and browsers warn visitors away from sites with an expired or missing security certificate. This guide covers the two halves of website security: the SSL certificate that encrypts the connection, and the protection of the site itself.
SSL certificates in plain terms
An SSL, or more exactly TLS, certificate lets visitors connect to your site over HTTPS, which encrypts the data between their browser and your server and shows that they have reached your domain.
| Type | What it checks | Suits |
|---|---|---|
| Domain validated | That you control the domain | Most small business sites. It is quick, often free, and encrypts just as strongly as the others |
| Organisation validated | The domain and details of the organisation | Sites that want to show a verified business identity |
| Extended validation | A more detailed check of the organisation | Rarely needed, since browsers no longer highlight it prominently |
| Wildcard | Covers a domain and all its subdomains | Sites with several subdomains |
Certificate lifetimes are getting shorter
Public certificates issued since 15 March 2026 can last no more than 200 days. The limit falls to 100 days for certificates issued from 15 March 2027, and to 47 days from 15 March 2029. Renewing by hand will soon be a regular chore, and an expired certificate shows visitors a full-page warning. So:
- Use automatic renewal, which many hosts and free certificate services provide
- Ask your host or web developer whether renewal is automatic, and who is responsible if it fails
- Set a calendar reminder for the expiry date as a backup
- Keep a list of every domain and subdomain that has a certificate
HTTPS checks
- The whole site loads over HTTPS, and plain HTTP addresses redirect to it
- No mixed content, meaning images or scripts still loaded over HTTP
- Your certificate covers the exact names visitors use, with and without www
- Consider HTTP Strict Transport Security once you are confident everything works. Free online tests will show you the state of your certificate and configuration
Protecting the site itself
- Updates. Keep the core software, themes and plugins up to date, and delete any you don't use
- Strong passwords and multi-factor authentication for admin, hosting and domain accounts
- Limit login attempts, and give each person only the access they need
- Backups stored off the server and tested. Our guide to disaster recovery and business continuity explains how
- A web application firewall, which filters malicious traffic before it reaches your site, often as part of a content delivery network that also absorbs floods of traffic
- Malware scanning and alerts when files change
- Trusted sources. Install plugins and themes only from reputable places
If you use WordPress, these steps are especially important, because the software's popularity makes it a frequent target. Managed hosting can handle some of this, as our guide to VPS, cloud and managed WordPress hosting explains.
If you take payments
Use a hosted checkout from your payment provider so that card details never touch your own server. That keeps your security duties under the card industry standard much simpler. Our guides to ecommerce platforms and to card machines and EPOS systems cover the payment side.
If your site is hacked
- Take the site offline, or put it into maintenance mode.
- Change passwords for hosting, admin and database accounts, and revoke any API keys.
- Restore from a clean backup made before the attack.
- Update everything, and remove anything you don't need.
- Scan for malware and find out how the attacker got in.
- Tell your host, who may be able to help.
- If personal data was exposed, you may have to report it to the ICO within 72 hours and tell the people affected. Our guide to UK GDPR for small businesses explains when.
The basics here overlap with the controls in Cyber Essentials certification, which is a useful target if customers ask what you do to stay secure.