Rules
Small Business Website Security Basics: Beyond Installing HTTPS
Small business website security basics go past HTTPS. These are the failures that cost owners money, why they hide for months, and what prevents them.
What to take away
- HTTPS encrypts traffic in transit. It does nothing about stolen logins, a plugin that ships malware, or card data stored in a database.
- The most expensive failures are quiet onesa skimmer or an open backup folder can run for months before anyone notices.
- The FTC treats weak security as a deceptive practice when a business promises protection it does not deliver, and every state now has a breach notification law with its own clock.
- Most prevention is cheap and boringfewer plugins, unique admin logins with multi-factor authentication, patched software, and card payments handed to a processor.
- If you accept cards on your own site, PCI DSS small business obligations still apply through your acquirer, even when you never see a full card number.
The costly one
Situation. A site runs a booking plugin that was last updated 14 months ago. The host patches the server, so the dashboard shows no warnings. A known flaw in the plugin lets an attacker write a payment skimmer into the checkout page.
How a stale plugin becomes a breach
- 14 months agoplugin last updated
- thenattacker writes payment skimmer
- 7 monthscard data captured
- laterbank passes fine to merchant
- laterattorney general asks about delay
Consequence. Card data from roughly 400 customers is captured for seven months. The card networks fine the acquiring bank, the bank passes the cost to the merchant, and the state attorney general asks why notification took so long. Owners often describe the total as a five-figure event, though amounts vary widely by card brand and volume.
Prevention. Inventory every plugin and theme, then remove anything without a current update and a named maintainer. Set a monthly patch window and keep a dated log. A written schedule is what an investigator asks for first.
The point of a patch log is not the patching. It is the dated record that you had a program.
The ones that look fine at first
Situation. The owner, a part-time marketer and a former contractor all share one administrator account. The contractor left 11 months ago.
Access and backup fixes
- One named account per person
- No shared logins
- MFA on every administrator
- Written offboarding steps
- Backups stored off the host
- Restore tested
Consequence. Nobody can say who changed the payment settings or uploaded a file. When the site is later used to send phishing mail, the hosting provider suspends the account and the business loses email for two days.
Prevention. One named account per person, no shared logins, and multi-factor authentication on every administrator. CISA publishes plain guidance on why MFA blocks most credential attacks. Offboarding steps belong in writing, and the SBA covers this in its cybersecurity guidance for small businesses.
Situation. A monthly backup runs to a folder inside the same hosting account, with directory listing left on.
Consequence. Anyone who finds the URL can download a full copy of the customer database. No alarm fires, because nothing broke.
Prevention. Move copies off the host, restrict access, and test a restore. Backup and recovery: a grounded overview explains why an untested copy is not a backup.
The ones that only show up later
Situation. The site collects names, emails and card numbers into its own database, and the owner assumes the payment processor handles everything.
Consequence. The database sits unencrypted on a shared server. A breach triggers notification duties under state law, and the processor's compliance paperwork does not cover data the merchant stored itself. PCI DSS small business rules still flow through the acquirer contract, which can require an annual self-assessment questionnaire.
Prevention. Stop storing card numbers. Use a hosted checkout so the processor holds the data. For the personal information you do keep, follow a data map and a retention limit. The FTC's Start with Security guide lists the storage and access habits investigators look for.
Situation. Email authentication records were set up once and never checked. A spoofed message to customers looks like it came from the business.
Consequence. Customers click, and the brand absorbs the damage. A missing DMARC policy is easy to spot from outside, which makes the business a soft target.
Prevention. Publish SPF, DKIM and a DMARC policy, then monitor reports before moving to a reject policy. The DMARC reference covers the record types and rollout order.
What they have in common
Every failure above stays invisible for months because nothing on the site looks broken. The page loads, orders arrive, and no error appears. Detection usually comes from an outside party: a card brand, a customer, a hosting abuse desk or a security researcher.
The pattern is the same in each case. Someone set a system up once, then treated it as finished. Websites are not finished. Plugins age, staff leave, and payment rules change.
A short review each quarter catches most of it. Check who has administrator access, confirm patches are current, verify backups restore, and read the acquirer's current requirements. Network security setup covers the parts of this that sit outside the website itself.
- Administrator list reviewed and former staff removed
- Plugin and theme inventory matches what is installed
- Backup restored to a test location in the last 90 days
- Card data confirmed absent from the site database
