There are two security problems a small business website runs into. The first is embarrassing: the browser tells every visitor your site is "Not Secure". The second is genuinely damaging: someone gets in and Google starts warning people away from you.
Both are preventable, neither is complicated, and the fixes are unglamorous. Here is what is actually going on and what to do about it.
The Not Secure warning, explained
If your address bar says Not Secure, it means one thing: your site is being served over plain HTTP rather than HTTPS. There is no encryption between your visitor and your site, so anything typed into a form travels in the clear.
It matters for three reasons. Visitors see the warning and many simply leave, because it reads as "this business is dodgy". Browsers show extra warnings on forms, so your contact form is actively discouraging enquiries. And HTTPS has been a ranking signal for Google for years, so you are quietly handicapped in search too.
How to fix it
- Get an SSL certificate. This should cost you nothing. Let's Encrypt certificates are free, valid and renew automatically, and virtually every decent host provides them at the click of a button. If your host wants a yearly fee for a basic certificate, that is a reason to question your host.
- Force HTTPS. Installing the certificate is not enough on its own. Every HTTP request needs to redirect to the HTTPS version, otherwise both exist and people still land on the insecure one.
- Fix mixed content. This is the step people miss. If your page loads over HTTPS but pulls in an image, font or script over HTTP, the padlock breaks anyway. Usually it is an old image path or an embedded widget, and the browser console will tell you exactly which.
Done properly, that is an hour of work at most, and often ten minutes.
How small business sites actually get hacked
Not by a hooded genius targeting your plumbing business. Almost always by an automated script scanning the whole internet for one specific known weakness. That changes what you should worry about:
- Out-of-date software. This is the overwhelming cause. An old WordPress core, theme or plugin with a publicly known vulnerability is what the bots are looking for. The exploit is usually published months before your site gets hit.
- Abandoned plugins. A plugin whose developer stopped updating it three years ago never gets patched. It is a permanent open window.
- Weak or reused admin passwords, and no two-factor. Automated login attempts run constantly against every site.
- Too many admin accounts. The web designer from five years ago probably still has full access.
- Cheap crowded hosting. On badly configured shared hosting, a compromise on a neighbouring site can reach yours.
What actually happens when you get hacked
Rarely anything dramatic on your homepage. Usually it is quiet and commercially nasty: hundreds of spam pages injected into your site, or visitors from Google redirected to somewhere unpleasant while you, logged in and visiting directly, see nothing wrong.
The damage lands when Google notices. You get flagged in its Safe Browsing system, and visitors start seeing a red warning screen instead of your site. Your traffic goes to essentially zero overnight. You will see it reported under Security Issues in Search Console, which is one more reason to have it set up, as covered in why isn't my website showing on Google. Getting that warning removed means cleaning the site properly and then requesting a review, which takes days you cannot afford.
The maintenance that prevents nearly all of it
Genuinely boring, genuinely effective:
- Keep everything updated. Core, themes, plugins. This one habit prevents the large majority of compromises.
- Delete what you do not use. Every deactivated plugin still sitting there is still code on your server.
- Strong unique passwords and two-factor on admin accounts. Free and takes minutes.
- Automatic backups you have actually tested. An untested backup is a hope, not a plan. Restore one somewhere safe and confirm it works, because the day you need it you will not want surprises.
- Audit who has access once a year and remove anyone who no longer needs it.
- Decent hosting. We host on Microsoft Azure, and our sites are built as static pre-rendered pages rather than a database-driven plugin stack, which means there is dramatically less for an automated attack to exploit in the first place.
What you do not need
An expensive certificate. The paid ones encrypt exactly as well as the free ones for a normal business site. Nor do you need a stack of overlapping security plugins bolted onto a site that has not been updated in a year, which is the digital equivalent of fitting a second lock to a door with no frame. Update first, then consider extras.
A five-minute check
- Visit your site and look at the address bar. Padlock, or Not Secure?
- Type your address with http:// at the front. Does it redirect to https, or load insecurely?
- If you are on WordPress, log in and look at how many updates are waiting. If it is more than a handful, that is your risk sitting in plain sight.
- Check Search Console for Security Issues.
- Confirm you have a backup from this week, and that you know how to restore it.
Frequently asked questions
Do I need to pay for an SSL certificate?
Almost certainly not. Free Let's Encrypt certificates are standard, browsers treat them identically, and most hosts include them. Paid certificates only make sense in specific commercial cases that do not apply to a typical local business site.
What should I do if my website has been hacked?
Take it offline or into maintenance mode, change every password including hosting and database, restore from a known clean backup, update all software before putting it back, and then request a review in Search Console if Google flagged you. If you are not confident, this is worth paying someone for, because a half-cleaned site gets reinfected within days.
Are security plugins worth it?
They can add useful things such as login rate limiting and file monitoring. But they are no substitute for updates, and running five of them at once mostly slows your site down. Get the basics right first.
How do I know if my site is compromised?
Check Search Console Security Issues, search site:yourdomain.com and look for pages you do not recognise, and try opening your site from a phone on mobile data where you are not logged in. Many infections deliberately hide from the site owner.
Does website security affect my SEO?
Yes, on both counts. HTTPS is a positive ranking signal, and being flagged as compromised is catastrophic for traffic while it lasts. Beyond rankings, the Not Secure label costs you enquiries from people who never mention why they left.
The honest summary is that website security for a small business is 90 percent housekeeping. Keep it patched, keep real backups, keep the padlock. If you would rather that was simply somebody else's job, it is included in what we do, along with the hosting. See our websites, read about the real annual cost of running a website, or get a free consultation and we will tell you honestly how exposed your current setup is.