Website security advice tends to either overwhelm ("here are 40 things to configure") or oversimplify ("just install a plugin"). Here's the realistic version — a handful of things that actually matter, in the order they matter.
If your site isn't served over HTTPS, browsers actively flag it as "not secure" to visitors, and Google treats it as a ranking signal. The SSL Store covers certificate options beyond whatever free option your host bundles, which matters if you need extended validation or wildcard coverage for multiple subdomains.
A web application firewall filters malicious traffic — bot attacks, common exploit attempts, credential-stuffing login attempts — before it ever reaches your actual site code. This is the single highest-leverage security addition for most small business sites, since it stops a large share of generic automated attacks that don't care what your site specifically does.
If you or your team access site admin panels over public or untrusted networks, that connection itself is a real exposure point. Surfshark covers this specific gap — encrypting the connection between whoever's logging in and the site, independent of whatever protection exists on the server side.
Most website attacks aren't a human specifically targeting your business — they're automated scans hitting millions of sites looking for known vulnerabilities, outdated software, or weak default credentials. Being small doesn't make you invisible to a scanner that isn't discriminating; it just means the attacker doesn't know or care who you are, which is exactly why baseline protection matters regardless of site size.
Unique, strong passwords per account (not reused across services), two-factor authentication on anything with admin access, and removing access for anyone who no longer needs it — a former employee or contractor with lingering login access is a genuinely common, entirely avoidable breach vector. None of this requires a purchased tool, just discipline that's easy to let slide once a site's been running smoothly for a while.
Outdated CMS software, plugins, and themes are the most common entry point for automated attacks specifically because known vulnerabilities in old versions are public information — an attacker doesn't need to discover anything new, just scan for sites still running the vulnerable old version. Enabling automatic updates where safe, and checking manually where automatic updates could break something, closes this gap.
Take the site offline or into maintenance mode immediately, identify the actual entry point rather than just removing visible symptoms, and change every credential with access — hosting, CMS, FTP, database. Rushing back online before confirming the entry point is closed just invites a repeat compromise shortly after.
If you can only do one thing this week: enable two-factor authentication on your admin login. It's free, takes minutes, and closes the single most common way sites actually get compromised — a stolen or guessed password with nothing else standing in the way.
