A small business website security checklist you can run this afternoon

You don’t need a security background to find the most common problems on your own website. Most of what goes wrong at small businesses comes down to a handful of things anyone can check: who can log in, whether the software is current, whether a backup really exists, and whether Google has already noticed something wrong.

Set aside an afternoon, open your site’s admin in one tab, and work down this list. Anything you can’t answer becomes your short list for a professional.

How do I know if my business website is secure?

You can’t be certain from the outside, but you can rule out the most common problems in an afternoon. Check whether Google has flagged your site, remove logins that shouldn’t exist, update your software, confirm a backup restores, and run a free scan. Whatever you can’t check yourself is what a security audit is for.

1. Check what Google already knows

Start with the free tools Google gives you, because they tell you whether your site is already compromised.

• Search Console. Open Security & Manual Actions, then Security issues. Google lists hacked content, malware and deceptive pages it has found on your site. If you’ve never set up Search Console, do that first. It’s free and takes minutes.
• Safe Browsing site status. Google’s Transparency Report has a lookup that tells you whether Google currently warns visitors away from your site.
• A quick search. Type site:yourdomain.com into Google and skim the results for pages you never wrote, often in another language or selling pills, casino games or knockoffs.

2. Clean up who can log in

Old logins are one of the most common ways in, and one of the cheapest to fix.

• List every account with admin access to your website, your hosting, your domain registrar and your email.
• Remove former employees, agencies and freelancers who no longer work with you. It’s common for a business that switched web developers years ago to find the old developer’s admin account still active.
• Turn on two-step login everywhere it’s offered, starting with hosting, email and your site’s admin.
• Use a password manager so every password is long and different. CISA’s Secure Our World campaign puts this next to two-step login as one of four everyday basics.

3. Update the software

Out-of-date software is the other big way in. October 2026’s PHP2Shell flaws were a reminder that this includes the server as well as your plugins.

• WordPress: update WordPress itself (7.1.3 was current in late October 2026), then every plugin and your theme. Delete plugins you don’t use, rather than just deactivating them.
• PHP: in WordPress, Tools → Site Health → Info → Server shows your PHP version. Anything older than 8.2 no longer gets security fixes from the PHP project.
• Shopify: open Settings → Apps and remove apps you no longer use. Shopify flags apps that haven’t been used in 30 days.

4. Confirm a backup actually restores

Ask your host or developer three questions: where are the backups, how far back do they go, and when did someone last test a restore? A backup nobody has restored is a hope, not a plan. Many hosts let you restore to a staging copy, which tests the backup without touching the live site.

5. Check your encryption and browser settings

• SSL Labs grades your SSL certificate setup. Tick “Do not show the results on the boards” if you’d rather keep the result private. Anything below an A is worth asking your host about.
• Mozilla’s HTTP Observatory checks the security headers that tell browsers how to treat your pages, with plain advice on each one it finds missing.

6. Run a malware scan

A remote scanner such as Sucuri SiteCheck looks at your site from the outside for injected code, spam and blocklisting. It’s a useful smoke test with a real limit: it can’t see what’s on the server. A clean result means nothing obvious is showing, not that the site is clean.

If you run WordPress, security plugins can scan files on the server too. Only point vulnerability scanners at sites you own.

7. Check your forms and checkout

Every public form attracts bots. Make sure contact and signup forms use a spam check such as Cloudflare Turnstile or reCAPTCHA. If you sell online, a sudden wave of tiny orders or failed payments may be card testing, and the same protection on checkout helps stop it.

8. Lock down your email domain

Criminals love sending invoices “from” small businesses. Three DNS records make that much harder: SPF, DKIM and DMARC. Your email provider’s admin console shows whether they’re set up. The FTC’s small business guidance covers email authentication if you want the background.

9. Write down who to call

Make a one-page list of every login your site depends on (hosting, domain, email, the site itself, payment processor) and who to call for each. Store it somewhere you can reach from your phone. When something breaks, this page saves hours.

Where to get more help for free

The government publishes solid small business guidance, and none of it costs anything: CISA’s Cyber Essentials, NIST’s Small Business Cybersecurity Corner, and the FTC’s Cybersecurity for Small Business pages. They cover the whole business beyond the website, and they’re a good next read.

When to call a professional

Call someone if Google has flagged your site, if you found accounts or pages you can’t explain, if you take payments online and haven’t looked at your checkout, or if you couldn’t answer the backup questions. Around Tampa Bay, plenty of business sites were built by small local shops that have since closed or moved on, and nobody has looked under the hood in years.

Our website security audit covers everything on this list plus the parts you can’t see from the admin: the server, the checkout scripts and a real restore test. If something already looks wrong, start with hacked website repair instead.

Common questions

How long does this checklist take? An afternoon for most small business sites. The logins and updates take the longest.

Is a free scan enough? It’s a good first look, but it only sees what a visitor sees. Problems on the server, in your admin accounts or in a forgotten app won’t show up.

What if I don’t have access to half of these logins? That’s a finding in itself. Start recovering access through your host and domain registrar now, before there’s an emergency.