Website security for business: HTTPS, backups, updates

Website security for a business rests on three basic practices: HTTPS with a valid certificate, regular tested backups and timely updates of the system and plugins. Add to them unique passwords with two-factor sign-in, the minimum necessary access rights and monitoring. These steps cover a large share of typical risks and let you get back to work quickly.

In brief

• HTTPS encrypts the data exchanged between the browser and the website; the certificate renews automatically, and its expiry date is monitored.
• Backups are stored off the website's server, have several restore points and are regularly test-restored.
• Updates to the system, themes, plugins and libraries close known vulnerabilities; unnecessary plugins are removed.
• Passwords are unique and kept in a password manager; sign-in to the admin panel is protected with two-factor authentication.
• Each employee has only the rights they need; access for former employees is revoked immediately.
• An incident response plan written in advance shortens downtime.

What risks a small website faces

A large share of attacks on small websites is automated: bots look for outdated plugins, weak passwords and exposed admin panels, and the size of the business makes no difference to them. Typical scenarios:

• malicious code and hidden redirects of visitors to third-party websites;
• spam pages that appear on the website and damage its reputation in search;
• leaks of inquiries and customer data;
• loss of control over the domain or DNS records;
• downtime due to a hosting failure or overload.

The consequences can be serious: lost orders, browser and search warnings, suspended ad accounts, reputational damage.

HTTPS: what to check

HTTPS encrypts data between the browser and the server and protects passwords, inquiries and payment data from interception and tampering. Browsers mark pages without HTTPS as not secure, and this scares visitors away from forms and payment. For search engines, HTTPS is a known, if small, quality signal. The certificate is usually issued by the hosting provider or the platform; many providers offer free certificates (for example, Let's Encrypt) with automatic renewal.

Checking HTTPS takes ten minutes:

1. Open the address with http:// and make sure the browser goes to https:// with a single 301 redirect.
2. Click the padlock icon next to the address and see who issued the certificate and when it expires.
3. Open the pages with forms and the catalog and make sure the browser shows no mixed content warnings (images or scripts loaded over http://).
4. Check that canonical tags, the sitemap and internal links point to https:// and to a single main version of the domain (with or without www).
5. Set up a reminder or monitoring for the certificate's expiry date.

When everything works correctly, you can turn on HSTS – a header that forces the browser to always use HTTPS. Turn it on after checking all subdomains.

Backups: what, where and how often

Back up the website files, the database, uploaded images and documents, and configuration files. The frequency depends on how quickly the data changes. The table gives guidelines.

• Follow the 3-2-1 rule: three copies of the data, on two different media, one of them off the main server.
• Keep several versions from different dates so you can roll back to a clean state if a problem was noticed late.
• Encrypt backups that contain personal data and restrict access to them.
• Once a quarter, restore a backup to a test environment and make sure the website starts.
• Hosting backups are useful as an extra layer; check the retention period and the restore procedure.
• On website builder platforms, find out which exports are available (catalog, orders, customers) and make them regularly.

Updates: system, plugins, themes

Updates close known vulnerabilities that automated scripts look for all over the internet. Update the CMS core, themes, plugins, libraries, the PHP version and other server components.

1. Make a fresh backup.
2. Test updates on a staging copy if the website is large or critical for sales.
3. Update the core first, then plugins and themes.
4. Go through the key scenarios: home page, form, cart, payment.
5. Record the date and versions in the change log.

• Remove unused plugins and themes: even a deactivated plugin can remain a source of risk.
• Install extensions from trusted sources; cracked copies of paid plugins often contain malicious code.
• Turn on automatic security updates where they are supported, and check the website after them.
• On website builders and SaaS platforms, the server side is usually updated by the vendor, while connected apps, scripts and integrations remain the website owner's responsibility.

Passwords, access and customer data

Accounts

• A unique password for each service and a password manager to store them.
• Two-factor authentication for the admin panel, hosting, domain registrar, e-mail, Google Analytics, Search Console and ad accounts.
• A separate account for each employee with the minimum necessary rights; avoid shared logins.
• Revoke access for former employees and contractors immediately.
• For the domain, turn on auto-renewal and protection against unauthorized transfer.

Forms, payment and personal data

• Spam protection for forms: a hidden field, rate limiting, server-side validation.
• Payment data is processed by the payment provider; card numbers are not stored on the website.
• Collect the minimum of personal data and keep it only as long as it is needed.
• For domain e-mail, set up SPF, DKIM and DMARC records so that e-mails get delivered and the domain is harder to spoof.
• Requirements for processing personal data (for example, the GDPR in the EU) depend on the country and change over time; check the current rules with a lawyer.

Monitoring

Monitoring helps you be the first to notice a problem: an uptime monitoring service, reminders about the certificate's expiry date, Search Console security issue notifications and a regular review of the change log.

Admin panel protection

• A limit on sign-in attempts and notifications about sign-ins from a new device.
• A custom username instead of the default admin.
• Ending inactive sessions and blocking sign-in from unnecessary addresses where possible.
• Restrictions on the types and sizes of files uploaded through forms and the admin panel.

Contacts in case of an incident

Keep the contacts of the hosting provider, domain registrar, payment provider and developer in one place outside the website. Decide who makes the call to take the website offline temporarily and who notifies customers if a data leak occurs. Such a note takes one page and saves hours during a real incident.

Incident response plan for a hack

A procedure written down in advance saves hours. An approximate sequence:

1. Record the symptoms: screenshots, dates, suspicious pages.
2. Temporarily take the website offline or turn on maintenance mode if malicious code threatens visitors.
3. Change the passwords for hosting, the CMS, the database, FTP or SSH, e-mail and other related services.
4. Find the cause: an outdated plugin, a leaked password, a compromised account.
5. Restore the website from a clean backup or clean up the files and the database.
6. Update the system and remove unnecessary components.
7. Check the security issues section in Google Search Console; if there is a warning, submit a review request.
8. Write down the results: what happened, how it was fixed, what was changed in the process.

Common mistakes

• Backups only on the same server. A failure or hack destroys the website together with the backups.
• Backups without a restore test. The problem comes to light at the moment the backup is needed.
• Postponed updates. An outdated plugin version becomes an easy target.
• One password for all services. A leak from one website opens up the rest of the accounts.
• Administrator rights for everyone. An editor needs only the editor role.
• Pirated themes and plugins. They often contain hidden backdoors.
• A certificate without a reminder. An expired certificate scares visitors away with a browser warning.
• No plan. During an incident, the team wastes time looking for the people in charge.

Questions and answers

Does a website without forms and payment need HTTPS?

Yes. HTTPS protects the integrity of pages, and browsers mark HTTP as not secure. In addition, some modern browser features require a secure connection.

How often should backups be made?

The frequency depends on how often the data changes and how much loss you are prepared to accept. A business card website is fine with a backup once a week and before changes, a store with orders needs one daily or more often.

Are websites on website builders and SaaS platforms secure?

The vendor maintains the server side and the platform, and this removes a large share of the tasks. Protecting accounts, passwords, employee roles and connected scripts remains the owner's job.

Does a website that does not change need to be updated?

Yes. Vulnerabilities are found in software whether or not the content changes. Old versions of the system and plugins become the main target of automated attacks.

What should I do if Google shows a dangerous website warning?

Check the security issues section in Google Search Console, find and remove the malicious code or pages, change the passwords, update the system and submit a review request. If you cannot manage on your own, bring in a specialist.

Conclusion

Website security consists of simple regular actions: HTTPS and control of the certificate's expiry date, tested backups off the server, timely updates, secure access and an incident response plan written in advance. Even a basic set of measures reduces the likelihood of a serious incident and shortens the recovery time if a problem does occur. Assign a person responsible for each action and put the check dates in the calendar – then protection works as part of daily routine without extra effort. Start with the simplest: check HTTPS, make a fresh backup and update the plugins. If you need help, LightSEO can help you build a secure corporate website or online store and set up basic protection.

Read also

• How to speed up a website: images, fonts, scripts
• Multilingual website: UX and SEO – URL structure, hreflang, language switcher
• 404 page: how to make it useful – design, copy and response code