Website security basics for small organisations
You do not need to be a big target to be a target. Six practical habits that make your website much harder to compromise.
It is easy to think hackers only go after large companies. In reality, most attacks are automated. Software scans the internet looking for any website with a known weakness, large or small.
The good news is that a handful of habits stops most of them.
Six habits that make a real difference
- Keep everything updated. Your website platform, themes and plugins all receive fixes for newly found weaknesses. Updating promptly closes the door.
- Use strong, unique passwords. A password manager makes this easy. Never reuse the same password across accounts.
- Turn on two-step login. Even if a password leaks, a second step stops most break-ins.
- Give people only the access they need. A contributor who writes articles does not need administrator rights.
- Remove what you do not use. Old plugins, unused themes and forgotten user accounts are common ways in.
- Keep backups and test them. If the worst happens, you can go back to a clean version.
Warning signs
Tell someone quickly if you notice:
- Pages or links you did not create
- Your site redirecting visitors somewhere strange
- A browser or search engine warning about your site
- Sudden slowness, or emails going out that you did not send
Security is a shared job
Servers need protecting, and so do logins, content and add-ons. Knowing who is responsible for what avoids gaps. Where we look after your website, we take on most of this work; where your own team does, we make the split clear from day one.
A note on standards
Good practice here is shaped by recognised frameworks such as the ISO/IEC 27000 family of information security standards. You do not need to read them to benefit. The habits above are a practical, everyday version of the same ideas.
Want a second pair of eyes on your website's security? Ask our team about a security review.