How to Keep a Business Website Secure and Maintained

Serious about results?

If your website brings in enquiries or sales, somebody needs to be looking after it. Too often nobody is, and owners find out the hard way. This page covers why small sites get attacked, what routine care on a typical WordPress site actually involves, the bits everyone forgets (the domain, the certificate, the backups) and what the law expects if personal data goes walkabout.

In brief

The NCSC says small businesses are just as likely to experience online crime as big ones. A lot of website attacks are bots hunting for old software and weak logins.
Updates, backups you’ve actually tested and 2-step verification on every admin account do most of the work.
HTTPS is the bare minimum now, and certificate lifetimes are being cut in stages, so renewals need to be automatic. Keep the domain in your business’s name while you’re at it.
Personal data breach? Under UK GDPR, notifiable ones go to the ICO within 72 hours.

Why small business websites get compromised

“Who’d bother hacking us?” It’s a fair question, and the National Cyber Security Centre has a blunt answer in its guide for small organisations. Small firms are just as likely to be hit by online crime as big ones, and if you think you’re too small to be a target, you should think again.

A lot of it isn’t personal anyway. Usually nobody’s sat in a dark room picking out your business. Software does the rounds, working through huge numbers of sites, poking at the same known holes, and it couldn’t care less whether it lands on a national retailer or a two-person accountancy practice.

So what’s it poking at? Old plugins and themes are high on the list. That’s why WordPress’s own hardening docs tell you to keep plugins updated and bin any you’re not using. The other favourite is the login page. WordPress calls brute force the simplest way in, which is just guessing usernames and passwords over and over until one works. It’s all automated, so even the failed guesses can swamp a small site with requests.

And you often won’t know. One week a plumber’s site is fine, the next it’s quietly hosting spam pages about something else entirely. A clinic’s booking page starts sending a few visitors off to who knows where. Search Console’s Security Issues report sorts this sort of thing into hacked content, malware and unwanted software, and social engineering. Google can put a warning on your listing in the results, or show a full-page warning in the browser before anyone reaches you. Enquiries dry up, sometimes for weeks before anyone twigs. Plenty of the common website problems worth fixing first are small maintenance gaps just like this.

Updates to WordPress core, themes and plugins

Updates exist because somebody found a flaw and fixed it. The NCSC’s line is to update by default, which means applying software updates as soon as you can, ideally automatically. That goes for a website just as much as a laptop.

WordPress has got much better at this. Its documentation says automatic updates of WordPress are switched on for most sites by default, and since version 5.5 you’ve been able to turn on auto-updates for individual plugins and themes with the ‘Enable auto-updates’ link. WordPress will then email you when one of those auto-updates works or fails. Read those emails. Don’t let a filter bury them.

Should everything update itself? Not always. For a tree surgeon’s brochure site, or a small charity’s, turning on auto-updates for well-maintained plugins is usually fine. An online shop with a payment gateway is another matter. So is a membership area, or a theme that’s been heavily customised. If an update breaks checkout on a Saturday morning, that’s real money gone, so on sites like these a person should apply the updates and check them, ideally on a staging copy first. Either way, back up before you update. WordPress’s own upgrade guide says the same, so you can put things back if it goes wrong.

Then there’s the stuff underneath WordPress. The requirements page currently recommends PHP 8.3 or greater and MariaDB 10.11 or MySQL 8.0 or greater, and warns that older versions have reached end of life and may leave your site open to security vulnerabilities. None of that lives in your dashboard. It’s down to your host, which is partly why hosting gets its own section further down.

Backups you can actually restore

A backup turns a disaster into an inconvenience. The NCSC’s small organisations guide tells you to back up all the data your business needs to run, and the website sits on its list next to emails, invoicing and customer information. Ransomware locking your files, hardware just giving up, there are plenty of ways to lose access.

With WordPress you need two things. The database holds your posts and site data. The files hold WordPress itself, your plugins, themes, images and uploads. That’s how WordPress’s backup documentation splits it, and one without the other won’t get you back where you were. It also suggests keeping several recent copies in different places, say one on the hosting server, one in cloud storage and one downloaded to your own machine, with weekly backups for quiet sites and daily ones for busy sites.

How often really depends on the business. A café that changes its menu page twice a year can relax a bit. An online shop taking orders every hour can’t, because a lost day of database means lost order records. What applies to everyone is the NCSC’s point about restoring. Know how to restore your backup, and check it actually contains what you need. A backup nobody’s ever test-restored is really just a hope. And if the only copies live with your host, they share the site’s weak spot when the hosting account is the thing that breaks. The NCSC also suggests putting 2-step verification on online backups.

Logins, passwords and 2-step verification

The NCSC’s list of important accounts to lock down names your company website, plus your domain hosting if that’s a separate login. If a service offers passkeys, the NCSC recommends them as a simpler and more secure way in than passwords or 2-step verification. Still on passwords? Use a strong one you don’t use anywhere else, and switch on 2-step verification, which the NCSC calls one of the most effective ways to protect online accounts.

WordPress says much the same. Its hardening guide suggests two-step authentication as an extra layer, and its brute force guidance says don’t use ‘admin’ as a username, use long unique passwords or passphrases, and keep them in a password manager.

Then look at who can actually get in. WordPress has roles so that not everybody needs the keys to everything. An Administrator can reach every admin feature. An Editor can publish and manage posts, and an Author can publish and manage their own. If the marketing assistant at a solicitor’s office only ever writes news posts, they don’t need Administrator rights. The NCSC also says to review accounts and remove the ones staff and contractors no longer need. That includes the freelancer who built a landing page three years ago and somehow still has a login.

HTTPS and SSL/TLS certificates

HTTPS encrypts the connection between a visitor’s browser and your site, using a certificate. People still call it an ‘SSL certificate’, though the protocol these days is TLS. Google said back in August 2014 that it would start using HTTPS as a ranking signal, a very lightweight one affecting fewer than 1% of global queries at the time. Rankings were never really the point. The browser warnings are.

Chrome started marking every HTTP site ‘not secure’ in July 2018, with Chrome 68. Google wants to go further. In October 2025 it announced plans to switch on ‘Always Use Secure Connections’ by default for public sites in October 2026, alongside Chrome 154, so Chrome would ask the user’s permission before first opening any public site without HTTPS. These rollouts can be gradual, so treat that date as Google’s stated plan. For a site still on plain HTTP it would mean one more warning screen between a visitor and your contact form. WordPress lists HTTPS support among its hosting requirements too.

Most sites have a certificate already, so the real question is renewals. In April 2025 the CA/Browser Forum, which sets the rules for publicly trusted certificates, passed a ballot to cut the maximum certificate lifetime in stages from 398 days to 47. The cuts run from March 2026 to March 2029. Renewing by hand once a year won’t do any more. Make sure your host renews automatically, and know who gets the alert when a renewal fails. If you’re seeing mixed content warnings or pages loading over HTTP, that overlaps with the checks in our guide to keeping pages quick to load.

Hosting and your domain name

Cheap shared hosting or managed hosting

The WordPress hardening guide says your hosting environment is a good place to start with security. Budget shared hosting can be fine for a small site, but the responsibility usually lands on you. You pick the PHP version. You set up backups. You notice when something slows down or stops. Managed hosting generally takes more of that off your plate, with the provider handling server updates, backups and security measures, and you’re paying for the time that saves.

To compare them fairly, ask each provider the same things and write the answers down. Which PHP versions do they support, and who does the upgrading? Then find out how often backups run, where they’re kept and what a restore involves. Check certificates renew automatically, and ask who answers the phone if the site falls over on a Sunday. A holiday let business taking bookings online will need different answers from a manufacturer whose site is mostly a brochure. If you’d like to talk it through, we offer managed website hosting.

Who owns your domain name

For some businesses the domain name causes more grief than any hacker. The usual story is a registration sitting in a former employee’s name, or the last web designer’s, and nobody has the login. For .uk domains, Nominet’s registrar guidance describes the account name as the company or individual the domain is registered on behalf of, and says individuals and sole traders should use their real name there, because a trading name alone isn’t enough. Make sure the registrant is your business, and that the contact email is one somebody will still read in five years.

Renewals matter because the fallout comes in stages. Under Nominet’s current expiry process, a .uk domain keeps working for 30 days after expiry and can still be renewed. From 30 to 90 days it stops resolving, so your website and email go dark, though you can still renew. Between 90 and 95 days it can’t be renewed at all. After that it drops at a time Nominet publishes in advance, and anyone can register it.

Generic domains like .com fall under ICANN’s Transfer Policy for moves between registrars. ICANN explains that the registrar creates the Auth-Code to identify the domain holder and prevent unauthorised transfers, and that registrars may deny a transfer within 60 days of initial registration or of a previous transfer. Under the current policy a change of registrant also triggers a 60-day transfer lock, unless your registrar let you opt out beforehand. ICANN has been reviewing these rules and shorter locks have been proposed, but there was no start date at the time of writing. Keep the registrar lock on, keep the Auth-Code to yourself, and treat that registrar login like your online banking.

Personal data and breaches

Most business websites collect personal data somewhere, through a contact form, a quote request, a newsletter sign-up or a customer account. UK GDPR’s security principle, as the ICO sets it out, says personal data has to be protected with appropriate technical or organisational measures. On a website, a good chunk of that is just the maintenance in this guide.

The ICO defines a personal data breach as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. If a breach is likely to result in a risk to people’s rights and freedoms, you must report it to the ICO without undue delay and not later than 72 hours after becoming aware of it. If the risk to individuals is high, you have to tell them directly too. And the ICO expects you to record every breach, whether it needed reporting or not. A hacked enquiry form on a physio clinic’s site could count. So could a leaked customer list from an online shop. Decide now who’d make that call. This is general information rather than legal advice, and the ICO’s guidance is where to check the detail for your situation.

Monitoring and a sensible maintenance schedule

Loads of website problems never announce themselves. The contact form stops sending. A plugin update breaks the quote calculator on a builder’s site. The booking page throws an error, but only on mobile. Uptime monitoring tells you when the site’s down, and Search Console tells you when Google spots security or indexing issues, which our guide to search visibility for business sites covers properly. Neither will tell you enquiries have quietly stopped. For that you need a regular test submission.

Weekly

Read the update and backup emails, and apply or review any pending updates.
Send a test enquiry through each important form and make sure it arrives.
Have a quick look at uptime alerts and any Search Console messages.

Monthly

Remove plugins and themes you’re not using any more.
Go through user accounts and roles, and remove anyone who’s left.
Test-restore a backup to a staging copy. At the very least, confirm the files and database are both there.

Yearly

Confirm domain renewal dates, registrant details and who holds the registrar login.
Check the PHP version on your hosting against what WordPress recommends.
Read through your privacy information and forms, and ask whether the site’s still doing its job. If the answer keeps coming back no, have a look at the signs that a website needs a redesign, along with our notes on what to decide before a new site is built.

Getting help with website care

You can do all of this yourselves if somebody on the team has the time and the patience, and the checklist above is a decent start. Where it usually falls apart is consistency. Updates slide in a busy month. The one person who knew the domain login leaves. Backups sit untested until the day you need them.

If you’d rather hand the routine stuff over, we offer WordPress website care plans alongside a hosting service. And if the site underneath is past the point where patching makes sense, we do website design too. To work out which level of website maintenance suits your site, get in touch with us and tell us a bit about how it’s set up.