Security Basics Every Business Owner Should Know

Nobody thinks about website security until something goes wrong. Then it’s a scramble — your site’s down, customer data might be exposed, and you’re trying to figure out how it happened and who to call.

You don’t need to become a security expert. But you need to know the basics — the stuff that prevents 90% of problems before they start.

HTTPS: The Padlock in the Browser

Look at your website’s URL. Does it start with https:// or just http://?

If it's just http://, your site is not encrypted. Everything sent between your visitors and your website (form submissions, passwords, credit card numbers) can be intercepted by anyone on the same network.

HTTPS encrypts that connection. It’s why you see the little padlock icon in your browser’s address bar.

Every website should have HTTPS. It’s been free through Let’s Encrypt since 2016. If your site doesn’t have it, ask your hosting provider to enable it. If they can’t or won’t, find a new hosting provider.

Google also uses HTTPS as a ranking factor. A site without it looks sketchy to both visitors and search engines.

Backups: Your Safety Net

Imagine waking up tomorrow and your website is gone. Deleted, corrupted, hacked — doesn’t matter why. Can you get it back?

If you don’t have backups, the answer is no. You’d have to rebuild from scratch.

Backups should happen automatically, at least weekly, and be stored somewhere separate from your website. If your site is on Server A, your backups shouldn’t also be on Server A. That’s like keeping your spare house key inside the house.

Ask whoever hosts your site: “How often are backups created? Where are they stored? How would I restore one if I needed to?” If they can’t answer clearly, that’s a problem.

Passwords: The Obvious Stuff That People Skip

You know you shouldn’t use “password123” as your password. But most people still use weak passwords or reuse the same password everywhere.

If someone gets your email password and you use the same password for your website admin, your hosting account, and your payment processor — they now have access to everything.

Use a password manager. They generate random passwords and remember them for you. One strong master password to remember, and everything else is handled.

Two-Factor Authentication (2FA)

Even a strong password can be stolen. Phishing emails, data breaches, someone looking over your shoulder. Two-factor authentication adds a second layer.

With 2FA enabled, logging in requires your password plus a code from your phone. Even if someone has your password, they can’t get in without your phone.

Enable 2FA on everything important: your email, your website admin, your hosting account, your payment processor. Most services support it now — look for it in your account security settings.

Keep Software Updated

If your website runs on WordPress, Drupal, or any other content management system, it needs updates. Same for plugins, themes, and server software.

These updates often include security patches. When a vulnerability is discovered, the fix goes out in an update. If you don't install it, you're running software with known holes, and hackers know exactly how to get through them.

This is another thing to ask your hosting provider or web agency: “Who handles updates? How often? What happens if a security patch comes out?”

What to Do If Something Goes Wrong

If you suspect your site has been hacked:

1. Don’t panic and start deleting things. You might destroy evidence of what happened.
2. Contact your hosting provider immediately. They can often tell what happened and when.
3. Change all passwords related to the site: hosting, admin, FTP, database.
4. Restore from a clean backup if you have one.
5. Figure out how it happened so it doesn’t happen again.

If customer data might have been exposed, you may have legal obligations to notify them. This varies by state and industry — know your requirements before you need them.

The Bottom Line

Security isn’t something you set once and forget. It’s ongoing: updates, backups, strong passwords, 2FA. The basics aren’t hard, but you have to actually do them.

Talk to whoever manages your website. Make sure these boxes are checked. The time to think about security is before something goes wrong.