What Website Security Actually Requires
A secure business website rests on five basics: HTTPS encryption, current software and plugin versions, regular backups, controlled account access, and some form of ongoing monitoring. None of these require a technical background to understand at a decision-making level — you don’t need to know how to patch a vulnerability, but you do need to know whether someone is doing it and how often.
Most website security incidents aren’t the result of a sophisticated targeted attack. They’re the result of one of these five basics being skipped for months or years until an automated scan finds the gap.
Quick-Reference: Common Security Gaps
| Gap | Warning Sign | Quick Fix |
|---|---|---|
| No HTTPS / expired certificate | Browser shows “Not Secure” in the address bar | Install or renew an SSL/TLS certificate |
| Outdated CMS, theme, or plugins | No one can recall the last update | Schedule regular update checks, not just when something breaks |
| No recent backup | Can’t say when the last backup ran or where it’s stored | Set up automated, tested backups on a fixed schedule |
| Shared or leftover admin accounts | Former employees or vendors still have login access | Audit accounts and revoke unused access |
| No monitoring or alerts | You’d only find out about an issue from a customer complaint | Add uptime and malware monitoring with alerts |
Treat this table as a starting checklist — some of these apply differently depending on your platform and hosting setup, so confirm specifics against your own site rather than assuming one setup matches another.
HTTPS Encryption
What it means: HTTPS encrypts the data moving between a visitor’s browser and your website, protecting anything submitted through a form — contact details, payment information, login credentials — from being intercepted in transit.
Common causes of gaps:
- ✓ A certificate that was never installed after launch
- ✓ A certificate that expired and was never renewed
- ✓ Mixed content, where some page elements still load over an insecure connection
What to do:
Check for the padlock icon and “https://” in your browser’s address bar on every major page of your site, not just the homepage. Google’s own page experience documentation includes secure serving (HTTPS) as one of the self-assessment factors it recommends site owners check, alongside Core Web Vitals and mobile usability.
Keeping the Platform and Plugins Updated
What it means: Content management systems, themes, and plugins are software, and software gets patched when vulnerabilities are discovered. An unpatched site is a known, published target, not a hypothetical risk.
Common causes of gaps:
- ✓ Updates are only checked when something visibly breaks
- ✓ Plugins or add-ons that are no longer maintained by their original developer
- ✓ No one is clearly responsible for checking for updates on a schedule
What to do:
Establish a fixed cadence — monthly at minimum — for checking and applying available updates, and remove any plugin or add-on that hasn’t been updated by its developer in over a year. If your team can’t answer “who checks for updates and how often,” that’s the gap to close first.
Backups You’ve Actually Tested
What it means: A backup that exists but has never been tested for restoration isn’t a real safety net — it’s an assumption. Backups protect against everything from hosting failures to accidental deletions to a successful attack.
Common causes of gaps:
- ✓ Backups are configured once at launch and never verified again
- ✓ Backups are stored in the same place as the live site, so one failure takes out both
- ✓ No one has actually attempted a test restoration
What to do:
Confirm backups run automatically on a fixed schedule, are stored somewhere separate from the live hosting environment, and have been test-restored at least once. If your current setup can’t answer all three, treat that as unresolved risk rather than coverage you can rely on.
Account Access and Password Hygiene
What it means: Every login credential with access to your website is a potential entry point, including ones that were only ever meant to be temporary — a former employee, a past contractor, or an old agency relationship.
Common causes of gaps:
- ✓ Shared login credentials used by multiple people instead of individual accounts
- ✓ Access never revoked after an employee or vendor relationship ends
- ✓ Weak or reused passwords on administrator-level accounts specifically
What to do:
Audit who currently has access at least twice a year, remove anyone who no longer needs it, and require individual accounts with strong, unique passwords for anyone with administrator-level permissions. Two-factor authentication on admin accounts closes most of the remaining gap.
When to Bring in Help Instead of Guessing
If you can’t confidently answer who last updated your site’s software, where backups are stored, or who still has login access, that uncertainty is itself the risk — not a minor administrative gap. Get a Free Consultation with SDB4U at 416-477-3285 and we’ll help you assess what’s actually in place versus what only looks like it is.
FAQ
Does my small business website really need HTTPS?
Yes. Any site collecting information through a form — even just a contact form — should encrypt that data in transit, and HTTPS is also part of the page experience factors Google documents for search visibility.
How often should website software be updated?
At minimum, check monthly for available updates to your CMS, theme, and plugins, and apply security-related updates as soon as they’re available rather than batching them with less urgent changes.
How do I know if my backups actually work?
The only real way to know is to test a restoration, not just confirm a backup file exists. If you’ve never done a test restore, schedule one — it’s the difference between assumed coverage and confirmed coverage.
What’s the single biggest security risk for a small business website?
Leftover access — former employees, past contractors, or old agency accounts that were never revoked. It’s the most common gap because it isn’t tied to a specific piece of software failing; it’s simply forgotten.
Do I need a security expert on staff to keep my website secure?
No. Most of these basics can be handled through scheduled maintenance and the right hosting/monitoring setup rather than in-house expertise — see our guide on website maintenance checklists for what that looks like month to month.
Disclaimer
Google is a trademark of Google LLC. SDB4U is not affiliated with, endorsed by, or sponsored by Google. All product names, logos, and brands are property of their respective owners.