Practical steps to protect a business website from account takeover, malicious uploads, fake enquiries, ransomware and preventable data loss.
Protect the accounts that can change the site
Most small-business websites depend on a handful of privileged accounts: hosting, domain registration, email, CMS administration and payment services. Use different passwords, enable multifactor authentication, remove former staff access and limit each user to the tasks they need. Keep a documented account owner and a safe recovery method. Shared administrator passwords make it difficult to investigate what happened after an incident.
Treat public forms and uploads as untrusted
Contact forms, file uploads, comments and registration pages are common entry points for abuse. Validate all fields on the server, use rate limits and a well-configured bot challenge, and avoid sending automatic email acknowledgements for suspicious submissions. File uploads need type validation, protected storage, file-size limits and malware scanning where supported. Do not assume that a PDF or image extension makes a file safe.
Backups must survive the same incident
A backup on the same hosting account can be destroyed or encrypted along with the live website. Keep protected copies in a separate location, restrict access, and test restoring files and database records into an isolated environment. Document the time needed to recover and the amount of recent data that the business could reasonably afford to lose. For payment and customer systems, restoration tests should also confirm that records remain consistent.
Watch for signs of compromise
Unexplained administrator accounts, unfamiliar scheduled tasks, modified payment details, unexpected email volume, new executable files and sudden traffic spikes deserve investigation. Record important security events without exposing passwords or tokens in logs. If you suspect compromise, preserve evidence, isolate affected services, rotate credentials from a clean device and involve the hosting provider. Do not assume that merely removing one suspicious file resolves the root cause.
Make resilience part of normal operations
Patch the server runtime and dependencies, review domain and DNS controls, use HTTPS, test checkout and forms after updates, and assign a person responsible for incident communication. Good security is an ongoing operating practice. Start with our cybersecurity checklist and review managed cybersecurity support when the business needs more hands-on help.
What to do next
Write down the outcome you want to improve, the people responsible and the information needed to measure progress. Start with a manageable first phase, test it with real users and update the plan based on evidence rather than assumptions.
