Security Basics That Apply to Any Platform
Whether a site runs on WordPress, Shopify, Squarespace, or something custom, the same core risks apply: weak or reused passwords, outdated software, unencrypted connections, and no backup plan. This checklist covers the platform-agnostic basics every small business site should have, regardless of what it’s built on.
The Checklist
- SSL/HTTPS enabled sitewide — non-negotiable in 2026; browsers actively flag non-HTTPS sites as insecure.
- Two-factor authentication on every admin account — the single highest-impact fix against unauthorized access.
- Unique, strong passwords — no reused passwords across the admin panel, hosting account, and domain registrar.
- Automated, tested backups — a backup nobody has ever restored from is not a real backup; test the restore process at least once.
- Software and plugins kept current — outdated CMS versions and plugins are the most common entry point for automated attacks.
- A web application firewall — blocks a large share of automated attack traffic before it reaches the site at all.
- Limited admin access — only people who genuinely need admin-level access should have it.
- Monitoring for unexpected changes — knowing quickly if a file changes unexpectedly matters more than trying to prevent every possible attack.
What This Looks Like on WordPress Specifically
For a deeper, WordPress-specific version of this checklist — covering plugin choices, hardening steps, and WordPress-specific attack patterns — see our full WordPress security guide.
The Real Cost of Skipping This
A compromised small business site typically means downtime, a damaged reputation with customers, and in the worst cases, stolen customer data with real legal exposure. Most of these incidents trace back to one or two items on this list being skipped, not a sophisticated targeted attack.
Related reading: GDPR Compliance for Small Business and Website Accessibility Lawsuit Risk.
Frequently Asked Questions
Is this checklist different if I’m not using WordPress?
The core items — HTTPS, two-factor authentication, backups, updates — apply to any platform; only the specific implementation steps change by CMS.
How often should I review this checklist?
A quarterly review is reasonable for most small business sites, with backups and software updates checked more frequently, ideally automatically.
What’s the single highest-impact item on this list?
Two-factor authentication on admin accounts — it blocks the large majority of unauthorized access attempts even when a password is compromised.
If this was useful, tell Google you want more of it.
