Security and reliability are invisible right up to the moment they are the only thing anyone is talking about. The site is down during a campaign, the contact form has been silently failing for three weeks, or customer data has appeared somewhere it should not be.
None of the protection against that is glamorous, and almost all of it is cheap relative to the cost of the incident.
The baseline
Most breaches of small business sites are opportunistic and automated. A basic standard defeats the overwhelming majority.
- HTTPS everywhere, enforced, with automatic certificate renewal.
- Dependencies and platform kept current; unpatched plugins are the single most exploited path.
- Individual accounts for every person, with multi-factor authentication and no shared logins.
- Least privilege: contributors cannot install code, and nobody works day-to-day as a super admin.
- Secrets stored in a secret manager, never in the codebase or a shared document.
- Rate limiting and spam protection on every public form and endpoint.
Backups you have actually restored
An untested backup is a belief, not a safeguard. The two questions that matter are how much data you can afford to lose and how long you can afford to be down — and the answers determine backup frequency and retention.
Keep at least one copy outside the hosting account itself, so an account compromise does not take the backups with it. Then restore one, into a staging environment, at least once. The first restore always reveals something missing.
Monitor the things visitors depend on
Uptime monitoring on the homepage is the minimum, and it misses most real failures. The expensive outages are partial: the site is up, but the form silently stops sending, or checkout fails for one payment method.
- Synthetic checks on the critical paths: enquiry form, booking, checkout, login.
- Alerts on error rates and failed background jobs, not only on total downtime.
- Certificate and domain expiry warnings, weeks in advance.
- A visible log of email and integration delivery failures.
Handle personal data deliberately
Collect what you need, keep it as long as you need it, and be able to delete it on request. Restrict who can export customer records, and keep personal data out of analytics, logs and screenshots.
This is both a legal position and a practical one: data you never collected cannot leak.
Write the plan before you need it
A one-page incident plan is enough for most businesses. Who is called, who can access hosting and DNS, where the backups are, what gets communicated to customers and by whom, and how you confirm recovery.
Print it, or at least store it somewhere that does not require the site to be up. The worst time to work out who has the DNS login is during the outage.
Make it routine
Set a recurring maintenance window — monthly is enough for most sites — to apply updates, review access, check the backups and read the error log. An hour a month prevents most of the incidents that otherwise consume a week.