--- title: "Website Security Basics: A Practical Checklist | MCC" description: "Most small site breaches use simple weaknesses. Work through this plain checklist of passwords, updates, user accounts, forms and access control." url: "https://mcc-solutionsnj.com/websites/guides/website-security-basics-checklist-for-small-business" --- Guide · Updated October 12, 2026 # Website Security Basics: A Practical Checklist Attackers rarely target a small business by name. Automated tools scan for weak passwords and outdated software across millions of sites. Closing the common gaps stops most of the problems you are likely to face. By [Matthew Coleman](/about), MCC Solutions **Quick answer.** The basics are a unique long password for each account that touches your site, a password manager, two-step verification on hosting and your registrar, prompt updates, regular backups and removing accounts and plugins you no longer use. **Free tools:** [Search result preview](/websites/search-result-preview) · [Free website SEO check](/websites/seo-checker) ## Passwords and logins Use a unique, long password for every account that touches your site: hosting, domain registrar, website admin, email and any builder. A password manager makes this realistic. Turn on two-step verification wherever it is offered, particularly for hosting and the registrar. Avoid the username admin on WordPress. If you have it, create a new administrator with a different name and delete the old one. ## Keep software current Out-of-date themes, plugins and core software are the most common way sites are compromised. Turn on automatic updates for security releases where your platform supports it, and schedule a regular review for everything else. Remove software you do not use rather than leaving it deactivated, since deactivated code can still hold flaws. ## Control who has access List everyone with a login. Give each person the lowest level of access needed: a person who only writes blog posts does not need administrator rights. Remove accounts for former staff and freelancers on the day they leave. Use named accounts rather than a shared login so you can see who changed what. ## Protect forms, uploads and the login page Forms that accept file uploads can be abused, so restrict allowed file types and sizes. Add spam protection and limit login attempts, so automated guessing gets blocked. Consider renaming or protecting the default admin login address, or requiring a code in addition to the password. Keep the site on https and make sure your hosting plan includes basic firewall protections. ## Back up, scan and have a plan Security is never perfect, so recovery matters. Keep automatic off-site backups and test a restore. Use a scanning service or plugin that alerts you to changed files or known malware. Write a one-page plan: who to call, where backups are, and how to reset passwords. Be wary of pirated themes and plugins, which often arrive with hidden code. Buy or download software from official sources only. If you want a second pair of eyes on your setup, a website care provider such as MCC Solutions can review these items with you. ## A one-hour starter plan In your first hour, do four things. Put every login into a password manager and replace weak or repeated passwords. Turn on two-step verification for hosting and the registrar. Delete one unused plugin or user. Confirm a recent backup exists and note where it is stored. These steps cost nothing and block the attacks seen most often. After that, add a monthly reminder to check updates and review user accounts. Keep your recovery details current too. Two-step verification is only helpful if you can still get in when a phone is lost, so store backup codes somewhere safe and offline, and make sure the recovery email for each account is one you still read. Finally, keep the contact details for your host's security team handy. Knowing whom to call within minutes of noticing a problem is more valuable than any plugin, and it keeps a small incident from growing. ## Common questions **Is a security plugin enough?** It helps, but it does not replace updates, strong passwords, backups and limited access. **Do small sites really get attacked?** Automated scans hit sites of all sizes. Size matters less than whether the common gaps are open. **How often should I review security?** A short check each month and a full review a couple of times a year works for many small sites. This guide is general information. Search engines change how they work and their guidelines; check Google's current documentation for your situation. Nobody can guarantee a ranking. Let us handle it [### Website care & updates Monthly website care: updates, backups, security checks, speed and content changes for small businesses. Website care →](/websites/services/website-care)[### Technical SEO & schema markup Technical SEO for small business websites: indexing, sitemaps, redirects, canonical tags and schema markup for local businesses and services. Technical SEO →](/websites/services/technical-seo-and-schema) More guides - [Website Backups That Actually Restore When You Need Them](/websites/guides/website-backups-that-actually-restore) - [Hacked Website? What to Do in the First 24 Hours](/websites/guides/hacked-website-what-to-do-first) - [WordPress Updates and Plugin Safety: A Simple Routine](/websites/guides/wordpress-updates-and-plugin-safety-routine) - [WordPress vs Wix, Squarespace and Custom Sites Compared](/websites/guides/wordpress-vs-wix-squarespace-vs-custom-website) Free tools - [Website basics check](/websites/seo-checker) - [Is your website working for you? quiz](/websites/quiz) [All guides](/websites/guides) Reach small business owners working on their website and Google listing who read this guide: [advertise here](/advertise#websites). Do it yourself ### Small Business Website Starter A fast, mobile-friendly one-page site you edit in a text editor and host anywhere, with the sections a local service business needs and a plain setup guide. [See what's inside ($29)](/toolkits/small-business-website-starter) [Free sample](/toolkits/small-business-website-starter#free-starter)14-day full refund ## Rather have us handle it? Ask for a quote. [Get a Quote](/websites/#quote)[Call (908) 444-6373](tel:+19084446373)