You don’t have to be a security expert
The words website security can make everything sound terribly technical.
Firewalls. Malware. Authentication. Encryption. Updates. Backups.
If technology isn’t your thing, it’s tempting to decide that website security is something for your web developer or hosting company to worry about.
They certainly have a role to play.
But as a business owner, there are also some simple things you can do — and understand — that make your website considerably safer.
Start with your login
Your website administration area is a doorway into your business.
Protect it accordingly.
Don’t reuse the same password you use for your email, Facebook, online shopping and six other accounts.
Use a strong, unique password or passphrase and consider using a reputable password manager so you don’t have to remember dozens of complicated passwords.
Where it’s available, turn on multi-factor authentication (MFA) as well.
MFA adds another verification step when you log in, which means that obtaining your password alone may not be enough for someone to access your account. The Australian Cyber Security Centre recommends using MFA wherever possible, particularly for important accounts.
Keep your website software updated
Modern websites often aren’t one single piece of software.
A WordPress website, for example, may include WordPress itself, a theme and a collection of plugins that add different functionality.
Those pieces of software receive updates for many reasons, including fixing bugs, improving compatibility and addressing security vulnerabilities.
Ignoring updates indefinitely can leave known weaknesses sitting on your website.
That doesn’t mean you should blindly click every update button without considering backups or compatibility. If somebody manages your website for you, ask them:
Who is responsible for keeping the website software updated?
Make sure the answer isn’t “I thought you were doing it.”
Keeping software current is one of the basic protections recommended for Australian small businesses.
Make sure your website is being backed up
If something goes wrong, could your website be restored?
That’s the question that matters.
A backup gives you a copy of your website that may be used to recover it after a problem.
Find out:
- Is my website being backed up?
- How often?
- Where are the backups stored?
- How long are they retained?
- Who is responsible for them?
- Has anyone ever tested whether the website can actually be restored?
The ACSC recommends regular backups and having a clear backup plan rather than simply assuming your information is protected.
Be careful about who has access
Over the years, different people can accumulate access to a business website.
The original developer.
A staff member.
Someone who helped with SEO.
A marketing company.
A friend who fixed something once.
A contractor who hasn’t worked with you for three years.
Periodically review who can log in.
If someone no longer needs access, remove their account.
And where possible, give each person their own login with only the access they need rather than handing everyone the main administrator username and password. This also makes it easier to remove one person’s access without changing everybody else’s. The ACSC recommends limiting access according to what people actually need for their role.
Don’t forget your domain and hosting
Your website isn’t only the pages visitors can see.
Your domain name and hosting account are also important parts of your online business.
Make sure you know:
- Where your domain is registered
- Whose name and email address are on the account
- When it renews
- Who pays for it
- Where your website is hosted
- Who can access the hosting account
Your domain should also be renewed before it expires; the ACSC specifically recommends auto-renewal or reliable renewal notifications as part of securing a business website.
Someone else can manage these things for you.
But you should still know where they are and who controls them.
Look for HTTPS
When you visit your website, the address should begin with:
https://
HTTPS encrypts information travelling between a visitor’s browser and your website, helping protect information such as passwords and payment details while it is being transmitted.
If your website isn’t using HTTPS correctly, ask your website or hosting provider to investigate.
Be suspicious of unexpected messages
Website owners receive some wonderfully alarming emails.
Your website has been suspended.
Your domain expires today.
Your mailbox is full.
Your account will be deleted.
Some will be genuine.
Some won’t.
Don’t automatically click the link because the message sounds urgent.
Instead, go directly to the service you use, log into your account independently and check whether there really is a problem.
Urgency is a very effective way to make people click before they think.
If someone manages your website, ask questions
Paying someone to manage the technical side doesn’t mean you need to understand every plugin, server setting or security configuration.
But you are entitled to understand the basics.
Ask:
Are updates being managed?
Are backups running?
Who has administrator access?
Is MFA available?
What happens if the website is compromised?
A good provider should be able to explain those things in language you understand.
Five minutes is enough to start
You don’t need to fix everything today.
Start with five simple checks:
Is my website software being updated?
Do I know that backups exist?
Am I using a unique, secure login?
Can I turn on MFA?
Do I know who currently has access?
If you can answer those questions, you already know considerably more about the security of your website than you did five minutes ago.
And that’s the point.
Website security isn’t about becoming a cybersecurity expert.
It’s about making a few sensible things part of the way you run your business.
