In many small businesses, website security sits in an awkward place. The owner assumes the web developer handles it. The developer assumes the host handles it. The host assumes the site owner handles it. Everyone thinks of it as a technical matter, somewhere in the background.
That’s a mistake, not because owners need to become security experts, but because the consequences of a website security failure land squarely on the business: lost sales, damaged reputation, legal obligations and disruption. Decisions about risk belong with the people who own the risk.
This post explains how to think about website security in business terms, and what to ask of the people who look after your site.
Why it’s a business risk
Revenue
If your website generates enquiries, bookings or sales, a security incident can stop that flow, sometimes for days. A hacked site may be taken offline by the host, flagged with browser warnings or quietly redirect visitors elsewhere.
Reputation
Customers who see a warning, land on a scam page or receive spam from your domain may never trust your business quite as much again. Small businesses that depend on word of mouth feel this most.
Legal and regulatory obligations
If personal information is involved, such as names, contact details, booking information or anything more sensitive, you may have obligations to protect it and to respond properly if it’s exposed. In Canada, PIPEDA requires organizations it covers to report breaches of security safeguards that create a real risk of significant harm, notify affected individuals and keep records of breaches. Quebec’s Law 25 adds further obligations for organizations handling information about people in Quebec.
Operational disruption
Dealing with an incident consumes time: staff on the phone, managers making decisions, people reassuring customers. Email deliverability problems can follow if your domain is used to send spam.
Cost
Emergency clean-ups, possible legal advice, lost sales and recovery work add up quickly, and they arrive unplanned.
Thinking about it the way you think about other risks
You already manage risk in your business. You insure the building, lock the doors, back up the accounts and train staff on safety. Website security fits the same framework:
- What could happen? Hacks, outages, data exposure.
- How likely is it? For an unmaintained WordPress site, more likely than most owners think, because attacks are automated and constant.
- What would it cost? Estimate lost revenue, recovery costs and reputational harm.
- What reduces the risk, and what does that cost? Maintenance, monitoring, good practices and backups.
Framed this way, sensible protection usually looks inexpensive compared with the risk it reduces.
What good website security looks like
You don’t need to understand the technical details, but you should know the components exist and are in place:
- Updates applied promptly and safely. WordPress, themes and plugins kept current, with critical security fixes applied quickly.
- Minimal attack surface. Unused plugins, themes and accounts removed.
- Strong access control. Unique passwords, two-factor authentication for administrators and the lowest level of access each person needs.
- Monitoring. Alerts for malware, suspicious file changes and downtime.
- Backups. Automatic, off-site, kept long enough and tested.
- Secure hosting. Current server software, proper isolation and protection at the server level.
- Encryption. HTTPS everywhere, with certificates that renew automatically.
- A response plan. Who does what if something goes wrong.
Questions to ask the people who look after your site
Whether that’s a developer, an agency or your host, ask:
- Who is responsible for applying updates, and how often does it happen?
- How do you test updates before they go live?
- How would we know if the site were hacked? Who gets alerted?
- Where are our backups stored, how long are they kept and when was a restore last tested?
- Who has administrator access to our site, hosting and domain?
- What happens, step by step, if there’s a security incident? How quickly will you respond?
- Do we own our domain, hosting account and website?
Clear, confident answers are reassuring. Vague ones tell you there’s a gap.
What owners should do personally
A few responsibilities sit with the business, whoever manages the website:
- Keep ownership. Domains, hosting accounts and key logins should belong to the business, not to an individual employee or contractor.
- Manage access. Remove access promptly when staff or contractors leave.
- Use a password manager for business accounts, and require two-factor authentication.
- Decide your risk tolerance. If an outage would be very costly, invest accordingly.
- Review it yearly, like insurance.
A one-page summary for owners
It helps to keep a single page, reviewed once a year, that answers: what our website does for the business; what information it collects; who maintains it and how to reach them; where the domain, hosting and backups are and who has access; and what we’d do in an incident. Writing it down often reveals gaps nobody had noticed, such as a domain registered to a former employee or backups nobody has checked. It also makes handovers between staff or suppliers far smoother.
The takeaway
Website security isn’t an IT detail; it’s a business risk that affects revenue, reputation, legal obligations and operations. You don’t need to manage it yourself, but you do need to own the decision, know what good looks like and ask the right questions of the people you rely on.
If you’re not sure who’s responsible for your website’s security, or whether anyone is, get in touch. Our monthly maintenance plans make security someone’s job.