5 Easy Website Security Best Practices for Small Businesses
For small businesses, a website is one of the most effective ways to promote your company and sell your products. Unfortunately, a business website is also attractive to cyber criminals.
Why? Because a lot of money and data flow through your site, bad actors want to steal it.
Whether your website processes hundreds of expensive transactions daily or sees a small amount of traffic, a cybercriminal will eventually attack your company, especially if you make it easy.
Don’t let them.
Instead, practice basic website security to ensure a safe and trusted online business environment.
Unsure how to do this? Worried about big costs and an IT budget?
Let’s talk it through!
What is website security, and how should you think about it?
Let’s start by clarifying that we’re talking about website security, not network security. Here’s why the distinction matters.
Your website is your public face to the world, like a photographer highlighting their photos. It might also be your e-commerce storefront, like Amazon, or a gateway into your ecosystem — think of a membership-based site like the New York Times.
Website security uses several protective measures to keep your site free from cyber attacks. On the other hand, network security refers to technical protections deeper into your network (not just your website), including elements like an authentication server or active directory.
In this article, we’ll only focus on website security.
Website builders vs. website hosting providers
When you build your organization, one of your first choices will be whether to use a website builder or a website hosting provider (commonly referred to as “web hosting”). Here are the main differences between the two:
Website builders
Great if you have little or no coding experience.
Comes with easy-to-use tools to build your website.
Offers shared hosting (you share the server with other sites).
Offers services to build your website, plus a few related features like payment processing integration and CRM integration (and sometimes others).
Web hosting
Great if you want to customize your site.
Gives you complete control to build your website.
Offers shared hosting (you share the server with other sites) or dedicated hosting (you have the server[s] all to yourself).
Gives you the ability to host your site, store data, host other services, and even build your entire network if you like — basically, you can customize your entire solution.
And if you don’t have a website right now, no problem — this information can help you get ahead. (By the way, this post takes a deep dive into the comparison.)
The rising costs of cybercrime puts your bottom line at risk
Website security is important because the costs of cybercrime keep rising. According to IBM, the average cost of a data breach in the US is now $9.44 million, more than double that in the rest of the world.
That alone makes investing in cybersecurity an excellent investment. Those costs can derail your organization if you aren’t prepared.
Aside from the cost of a data breach, you also need to guard against unauthorized access, especially if your website is a doorway into your network.
If your site is critical to revenue generation, imagine losing access to it. This wouldn’t just cut into your bottom line; it would harm your reputation and destroy customer trust.
When thinking about website security, start with a specific idea of how your site functions and why you want to keep it secure. Consider this conceptual approach:
Objective vs. subjective truths in cybersecurity
Is your website “secure”? That’s a subjective question. Why? Because there’s no such thing as a perfect security solution, experts tend to have differing points of view.
For instance, two businesses can be equally secure (more or less) with different cybersecurity strategies and solutions. Or they can spend the same amount of money on cybersecurity — but get significantly different results. It all depends on how their cyber expert analyzes and reacts to the threat landscape.
Does that make sense? Let’s get a bit more detailed.
If two cyber experts analyze a business’s cybersecurity measures, they might agree that, objectively speaking, the company secured its attack surface.
But that might be the only thing they agree on.
One expert might subjectively argue that the company should have invested less in attack surface management and more in zero trust.
The other expert might subjectively say neither is essential and that the company should be focused on developing a small in-house security team.
So that’s the idea of subjective vs. objective truths in cybersecurity — cyber experts might agree that you need to take action but disagree on the best course of action.
This matters because cyber is a cat-and-mouse game. Your website is secure today, but what about tomorrow? What about next year?
But don’t throw your hands up in defeat! Some cybersecurity is better than no security, and you just need to stay on top of it. Cybersecurity will never be a fix-it-and-forget-it problem.
For SMBs, the best approach to website security is to do some homework, think about the big picture, look to the experts for guidance, and continually evolve.
5 tips for making your website secure
Think of these tips as best practices — easy things you can do to keep your business safe in an online world. Remember that you will have more flexibility and control with web hosting than with a website builder.
Choose the right hosting service
In the early days of online business, choosing a website builder or web hosting was limited and a bit confusing. The technology was evolving so quickly that sometimes it was tough even for specialists to keep up.
Fast forward a couple of decades, and the opposite is true. Nowadays, you have great options for building a business website.
If you’re starting out, you should work with a reputable player. For website builders, this would mean services like Wix, Squarespace, or Shopify. For web hosting providers, check out Hostinger, Hostgator, or Dreamhost. All of these do almost all your security. They’ll also tell you about other services and features for your situation.
When you want to scale — or if you’re larger to begin with — you have to consider higher levels of enterprise-grade security and delve into advanced hosting options (not just website hosting, but hosting your organization’s entire business operations). If that is you, you should start with web hosting.
Bottom line: A website builder is great if you’re starting out and only need a website, while web hosting is best if you have more complex needs and are looking to scale. Either way, shop around and find the right provider for your specific needs.
Talk to a cybersecurity professional
Small business owners tend to be natural problem solvers — it’s one reason they want to build their own companies. When they encounter challenges, they often like to go at them alone.
With cybersecurity, this is a mistake! Cyber is too complex a topic to figure out yourself. Expertise comes with extensive experience and training. The truth is every SMB should pay someone for cyber guidance. You should do this sooner rather than later.
Don’t want to commit to a long and costly partnership? No problem — take it one step at a time. Many cyber experts will offer you a one-time session for a set fee or limited part-time support.
Not sure who to talk to? No problem — there are lots of qualified experts out there. Just ask around. Chat with fellow business leaders, or email us to talk to one of our experts!
Bottom line: Cybersecurity is complex. There’s no shame in asking for help, especially when you’re building a website designed for commerce, particularly if that website is your sole source of revenue.
Backup your site regularly
In the digital universe, your data is your business. But what if you lost it all? What if there was a breach and you were cut off from accessing your information?
It’s a nightmare scenario — tragically, it’s more common than you think.
If you have a business, you need to back up valuable data regularly. Your hosting service will probably run backups automatically, but don’t assume anything — double-check with them.
You need to figure out the details. How frequently do they do it? How much do they capture? What’s the retrieval process?
Also, what if something goes wrong on their end? The fact is, you probably need two backups in two different locations.
Bottom line: Data backups can save you from epic disasters. It’s better to be safe than sorry.
Patch your systems regularly
These days, many hosting services will automatically update their software. But that’s not guaranteed. You can keep your site secure by figuring out their patch process (this mostly applies if you are using web hosting and building out your network in it).
For instance, if your site utilizes third-party plug-ins, those could be available for updates on a different schedule than your content management system (CMS). They also might not occur automatically.
No software is eternally flawless. It develops bugs and glitches, which can lead to (or be part of) security vulnerabilities. Cyber bad actors scan the web 24/7 for these types of easy entry points.
Don’t let them crawl into your site!
Bottom line: Update all your systems’ software as soon as possible.
Build layers of security around your site
To return to perhaps the most crucial point, money and data flow through your business website. Why leave security to chance?
Think about it: Would you go on vacation without locking your front door? Without activating your alarm system?
These are basic brick-and-mortar security practices, and we’ve discussed many of their cybersecurity equivalents in other articles.
So this last tip is about putting everything together and diversifying your defenses. In cybersecurity, there’s a principle called defense in depth, which means having multiple layers of protection.
Whatever term or concept you use, the point is the same: your website will only reach a state of “objective” security if it has more than one defensive measure. For a website, this means you will do things like:
Review your registrar and Domain Name System (DNS) records to ensure only authorized parties can access/change them.
Ensure your website's transactions are secure using Hypertext Transfer Protocol Secure (HTTPS).
Secure accounts for all users by enforcing good password practices and offering Multi-Factor Authentication (MFA)
Bottom line: With multiple security layers, you can rest assured that no bad actor can compromise one of your defenses and breach your site.
Conclusion
Websites are one of the most important ways businesses communicate with and sell to customers. Securing your website shouldn’t blow your budget or take a team of two-dozen cyber experts. Just follow our best practices, and you’ll be fine.
Do you want to use our content for your site or training material, or would you like us to write curated white-label content for you? We can help you! Let’s talk.
Snap out of it…and share this article! LOL
Are you looking to go to a persona page?
Cyber 101 | The Solopreneur | SMB | BoD
