Fluxx Tech
Small business websites are hacked more often than owners expect, usually not by targeted attacks but by automated bots scanning for outdated software and weak passwords. A hacked site can show spam, redirect visitors, steal data, get flagged by Google or disappear entirely.
The essentials
1. HTTPS everywhere
An SSL certificate encrypts data between visitors and your site and removes “Not secure” warnings. Many hosts provide it free.
2. Keep everything updated
Update your CMS, themes, plugins and server software regularly. Outdated plugins are among the most common entry points.
3. Strong passwords and two-factor login
• Unique, strong passwords for website admin, hosting, domain and email
• Two-factor authentication wherever available
• Remove old staff and agency accounts
4. Regular backups
• Automatic daily or weekly backups
• Stored off-site, not only on the same server
• Test restoring a backup occasionally
5. Secure hosting
Choose hosting with firewalls, malware scanning, isolation between accounts and good support.
6. Limit plugins and access
Fewer plugins mean fewer vulnerabilities. Give admin rights only to people who need them.
7. Protect forms
Use spam protection on forms, validate inputs, and avoid collecting sensitive data you don’t need.
8. Monitor
• Uptime monitoring
• Security alerts from your host or a security plugin
• Google Search Console security notifications
Signs your site may be hacked
• Strange pages or links in Google results for your site
• Redirects to unknown websites
• Browser or Google warnings
• Unknown admin users
• Sudden slowness or unusual traffic
What to do if hacked
1. Change all passwords immediately
2. Contact your host or developer
3. Restore a clean backup or clean the infected files
4. Update all software and remove unused plugins
5. Check for unknown admin accounts
6. Request a review in Google Search Console if your site was flagged
7. Inform customers if their data may have been affected, as required
Frequently asked questions
Is a small website really a target? Yes. Automated attacks target any site with known vulnerabilities, regardless of size.
Does SSL make my site fully secure? No. SSL protects data in transit; you still need updates, passwords and backups.
How often should I back up? At least weekly for simple sites; daily for sites with frequent changes, orders or bookings.
