Website Security Habits Every Business Owner Should Know

Website security starts with knowing who can change the site, what needs updating, where usable backups live, and who will respond when something looks wrong. A business owner does not have to perform every technical task. The owner does need a clear answer for each of those questions and a way to confirm the work happened.

Think of this as an operating routine, not a promise that a site can never be compromised. The right details depend on whether you use a content management system, a static site, hosted forms, booking tools, or several providers. Use the checks below to ask better questions of the people who manage them.

Know which accounts control the website

Make a short inventory of the domain registrar, DNS provider, hosting account, website administration, email connected to those accounts, and any services that handle forms or bookings. For each, record the business owner, the day-to-day administrator, the recovery contact, and where access instructions are held securely. You do not need to put passwords in the inventory.

Ask whether every person has their own account where the service allows it. Shared logins make it difficult to tell who changed something and awkward to remove access when a relationship ends. Give editors only the permissions their work requires; reserve administrator access for people who actually need it. Review staff and vendor access when roles change or a contract ends.

Turn on multifactor authentication for important accounts where available, especially the accounts that control the domain, hosting, and website. Keep recovery methods current so a lost phone does not leave the business locked out. If a provider or platform does not support these basics, document the limitation and ask what alternative safeguards are available.

Give updates an owner and a follow-through check

Identify what can change: website software, themes, extensions, server components, and connected tools. A static site may need fewer software updates than a content management system, but its hosting, forms, and other services still have owners. Ask who watches for updates, who decides when they are applied, and who checks the result.

Before a meaningful change, confirm that a usable backup exists and that the person doing the work knows which functions matter. After the update, open the site as a customer would. Check a key page, navigation, contact path, and any booking or purchase flow that applies. A successful update notice tells you the software changed; it does not confirm that customers can still finish their task.

Keep a simple change note: what changed, when, who handled it, and what was tested. If several people support the site, this record prevents the next person from having to guess whether an unexpected page change was planned. The broader website care plan guide explains how updates fit with content and support responsibilities.

Ask whether a backup can actually restore the site

Ask what the backup includes. A complete recovery may need site files, a database, uploaded media, settings, and details of connected services. The exact list depends on how your site is built. A copy of the homepage alone will not restore a booking system or customer submissions.

Find out where copies are stored, who can reach them, how access is protected, and whether they are separate from the live site. A backup that disappears with the hosting account or sits in a public web folder is a fragile recovery plan. Confirm who is responsible for restoring it and how that person can reach the right copy.

Ask for evidence of a recovery check appropriate to your setup. That might be a documented test restore or a review confirming that the necessary files and data can be read. Record the date, what was checked, and any gaps. Do not wait for a real incident to discover that the database or a required credential was missing.

Watch for changes you did not approve

Choose a person who notices and receives alerts about unusual account access, unexpected website edits, new administrator accounts, unfamiliar redirects, missing pages, or a sudden change in form delivery. The tools vary by site; the useful habit is assigning someone to review signals and decide what needs investigation.

Also look at the public site regularly. Open the homepage and an important service page on a phone and a computer. Check that links lead where they should and that the contact path still works. When testing a form, mark the message as a test and verify that it arrived through the expected route. Our contact-form testing guide covers that end-to-end check.

An unfamiliar change does not automatically mean an attack. It may be an approved edit that was not recorded, a failed update, or a provider issue. Treat the observation seriously, preserve what you saw, and have the responsible person investigate before changing several things at once.

Decide who gets the first call

Write a short response card that can be reached even if the website is down. Name the primary technical contact, a backup contact, who can reach the domain and hosting accounts, and who makes business decisions about customer communication. Include the support routes for important providers and where the account inventory and recovery instructions are stored.

Give staff a simple reporting instruction: note the time, page or account involved, what looked different, and any related notice. Send it through the agreed channel. Avoid forwarding passwords or sensitive customer information into a group chat. The technical contact can then assess the issue, preserve relevant evidence, contain the problem if needed, and advise on recovery or further help. If customer information may be involved, seek appropriate professional advice about any notification duties rather than guessing from a website checklist.

Practice the first step. Ask a colleague who they would contact if the site showed an unfamiliar page or an administrator received an unexpected login notice. If the answer is uncertain, improve the response card before an urgent day makes that uncertainty expensive.

Use a short owner review

During a regular website review, ask these questions and write down the answer, the person responsible, and the next check date:

• Who controls the domain, hosting, website, and connected customer tools?
• Do current staff and vendors have only the access they need, with multifactor authentication where available?
• Who watches for updates and confirms that important customer paths still work afterward?
• What is backed up, where is it kept, and what evidence shows it can be restored?
• Who reviews unusual changes or alerts, and how do staff report them?
• Who is contacted first if the site or an important account appears compromised?

Do not mark a question complete just because a provider says it is handled. Ask what they check and how you will know when an issue needs your decision. A useful security routine has named owners, observable checks, and a clear path for exceptions. If those pieces are missing, contact Sande Caplin & Associates to discuss a focused review of your website responsibilities and customer paths.