Website security basics: SSL, backups, updates and more

You do not need to be a security expert to protect a business website — you need five basics done consistently: enforce SSL/HTTPS, run automatic off-site backups, keep all software updated, use strong passwords with two-factor authentication, and monitor for problems. Get those right and the vast majority of attacks simply bounce off. Skip them and a small issue can quickly become a very public, very expensive one.

Key takeaways

• SSL/HTTPS is non-negotiable. It encrypts data, removes the browser "Not secure" warning, and is needed for any form or payment.
• Automatic, off-site, tested backups are your safety net. An untested backup is a hope, not a plan — restore drills matter as much as the backups themselves.
• Outdated software is the number-one cause of hacked sites, especially on WordPress. Patch core, themes and plugins promptly.
• Most breaches start with weak credentials. Strong unique passwords plus two-factor authentication stop the most common attacks.
• Custom-coded sites have a smaller attack surface, but every site still needs SSL, backups, updates and monitoring.
• Prevention is far cheaper than recovery. A simple, repeatable routine beats an expensive cleanup after the fact.

Why website security matters for small businesses

It is tempting to assume hackers only target big companies, but the opposite is usually true. Most attacks are automated: bots crawl the web around the clock looking for any site running outdated software, a weak password, or an exposed login page. They do not care whether you run a national brand or a one-person trades business in Halifax — they care whether you are an easy target. Small Canadian businesses are attractive precisely because they often lack a dedicated IT team.

The damage from a compromise rarely stops at the technical level. A hacked site can be defaced, used to send spam, loaded with malware that infects your visitors, or quietly turned into a host for someone else's scam. Google may flag your domain with a red warning screen, your email can start landing in spam, and customers who see "this site may harm your computer" rarely come back. For an e-commerce store, downtime and lost trust translate directly into lost revenue.

There is also a Canadian legal dimension. If your site collects personal information — names, emails, phone numbers, payment details — you have obligations under privacy legislation such as PIPEDA to protect that data and, in many cases, to report breaches. Security is not just a technical nicety; it is part of running a responsible business and protecting the trust customers place in you.

SSL / HTTPS: the foundation of trust

An SSL certificate (technically TLS today) encrypts the data travelling between your website and each visitor's browser. Without it, anything typed into a form — a contact request, a login, a credit card number — can be read in transit. With it, that traffic is scrambled, the padlock appears in the address bar, and your URL begins with https:// instead of http://.

Modern browsers actively label sites without SSL as "Not secure," which is enough to scare off a large share of visitors before they read a word. SSL is also a (small) Google ranking signal and a hard requirement for processing payments. The good news: it is almost always free. Most reputable hosts include automatic certificates through Let's Encrypt, and you can read more about choosing a provider in our guide to domains and hosting in Canada.

Getting SSL right

• Confirm it is installed — look for the padlock and an https address on every page, not just the homepage.
• Force HTTPS so visitors who type the old http address are redirected automatically.
• Fix mixed content — images, scripts or fonts still loading over http will break the padlock.
• Watch for expiry — automated certificates renew themselves, but it is worth a periodic check so a lapsed certificate never greets your customers.

Backups: your safety net when things go wrong

If SSL is the lock on the front door, backups are the insurance policy. Sooner or later something will break — a bad update, a corrupted database, a hosting failure, or an actual attack. When that happens, a recent backup is the difference between restoring your site in minutes and rebuilding it from scratch over several stressful days.

The single most common mistake is assuming a backup exists and works. Many businesses discover, at the worst possible moment, that their backups were never running, were stored on the same server that just failed, or simply will not restore. Treat backups as something you verify, not something you hope for.

What a solid backup routine looks like

1. Automate it. Daily backups for active sites; more often for busy stores. Manual backups get forgotten.
2. Store copies off-site. A backup on the same server as your site is useless if that server dies. Keep at least one copy somewhere separate.
3. Keep multiple versions. Retain a week or two of history so you can roll back past a problem you did not notice immediately.
4. Back up before every change. Always snapshot before updates, plugin installs, or redesign work.
5. Test the restore. Periodically restore a backup to a staging environment to confirm it actually works.

Reliable backups also protect the asset you have invested in. They are a practical part of making sure you genuinely own your website rather than being locked out of it by a single point of failure.

Updates: patch before attackers find the hole

Out-of-date software is, by a wide margin, the most common way websites get compromised. This is especially true on WordPress, where the core platform, themes and plugins are each released by different developers and patched on different schedules. When a security flaw is discovered and fixed, the fix becomes public — and bots immediately start scanning for sites that have not applied it yet.

Staying current is the heart of ongoing WordPress maintenance. The goal is not to chase every update the instant it appears, but to apply security patches promptly and test functional updates before they reach your live site.

A sensible update discipline

• Apply security updates quickly — these close known, actively exploited holes.
• Update on staging first for major version changes, then push to live once you have confirmed nothing broke.
• Remove what you do not use. Every inactive plugin or theme is still an attack surface; delete it rather than just deactivating it.
• Choose well-maintained plugins. Abandoned plugins never get patched — check that they are updated regularly before installing.

This is one area where architecture matters. A custom-coded site has far less third-party code to patch, which is part of the broader trade-off we cover in custom-coded versus WordPress. Fewer moving parts mean fewer doors for an attacker to try.

Passwords and access control

A surprising number of breaches have nothing to do with clever exploits and everything to do with weak or reused passwords. Automated "brute force" attacks try thousands of common passwords against login pages every day. The defences are simple and cost nothing.

• Use long, unique passwords for every account — your CMS admin, hosting control panel, domain registrar and email.
• Turn on two-factor authentication (2FA) wherever it is offered. Even a stolen password is useless without the second factor.
• Use a password manager so strong, unique passwords are practical to manage across your team.
• Give people only the access they need. Not everyone requires full administrator rights — limit privileges by role.
• Remove old accounts. When a contractor or staff member leaves, revoke their access the same day.

Pay particular attention to your domain registrar and primary email account. These sit at the top of the chain — whoever controls them can often reset everything else. Protect them with the strongest passwords and 2FA you have.

Monitoring and basic hardening

Security is not a one-time setup; it is something you keep an eye on. Monitoring tools watch your site and alert you the moment something looks wrong, so you find out from a notification rather than from an angry customer. The earlier you catch a problem, the smaller and cheaper it is to fix.

What to monitor

• Uptime — get an alert if the site goes down, so you can act before customers notice.
• Malware and file changes — scanners flag injected code or unexpected modifications.
• SSL and domain expiry — never let a certificate or domain registration lapse by surprise.
• Login attempts — repeated failed logins are an early warning of an attack in progress.

Simple hardening steps

Beyond monitoring, a few low-effort measures meaningfully raise the bar. Put your site behind a reputable web application firewall or CDN (services like Cloudflare offer free tiers) to filter malicious traffic. Limit login attempts and, where possible, change the default admin login URL. Keep your hosting environment current, and disable features and file editing you do not use. None of this requires deep expertise — most can be enabled in an afternoon and then largely left alone.

Fast, well-built sites tend to be easier to secure and maintain, which is one more reason the fundamentals in Core Web Vitals and a thoughtful build pay off over time.

What to do if your site gets hacked

Even with good habits, no site is perfectly immune. If you suspect a compromise, stay calm and work the problem methodically. A clear plan turns a crisis into a chore.

1. Take the site offline or put it into maintenance mode to stop it harming visitors or spreading further.
2. Change every password — CMS, hosting, database, FTP, registrar and email. Assume credentials are exposed.
3. Identify and remove the malicious code, or restore from the most recent clean backup taken before the breach.
4. Patch the hole that let them in — usually an outdated plugin or a weak password — so the same attack cannot recur.
5. Scan and verify, then ask Google to review the site if it was flagged, so warnings are removed.
6. Notify affected parties if personal data was exposed, in line with your privacy obligations.

This is exactly where tested backups and a maintenance plan earn their keep. If recovery feels beyond your comfort zone, that is a reasonable point to bring in help — our web design and maintenance services include cleanups and ongoing protection.

A practical website security checklist

Use this as a quick audit. If you can tick every box, your site is in good shape; any blanks are your priority list.

• SSL installed, HTTPS forced, no mixed-content warnings.
• Automatic daily backups, stored off-site, tested by a real restore.
• Core, themes and plugins updated; unused extensions deleted.
• Strong unique passwords with two-factor authentication on every key account.
• Access limited by role; departed users removed promptly.
• Uptime and malware monitoring with alerts enabled.
• A firewall or CDN filtering traffic and limiting login attempts.
• A written recovery plan and a known clean backup to fall back on.

Security and visibility go hand in hand — a trusted, well-maintained site supports your SEO and protects the reputation that drives leads from your website.

Frequently asked questions

Do I really need SSL on my website?

Yes. Browsers label sites without SSL as "Not secure," which drives visitors away and undermines trust. SSL is required to process payments, recommended for any form, and a minor Google ranking factor. It is also usually free through your host, so there is no good reason to skip it.

How often should I back up my website?

Back up automatically at least once a day for active sites, and more often for busy e-commerce stores. Store copies off-site, keep a week or two of history, and always take a backup before any update or change. Most importantly, test a restore periodically so you know the backups actually work.

Are custom-coded sites more secure than WordPress?

Custom sites have a smaller attack surface because there are no third-party plugins or themes to exploit, which removes the most common entry point. That said, no site is hands-off — every website still needs SSL, backups, strong passwords and monitoring regardless of how it was built.

What is the most common way websites get hacked?

The two biggest causes are outdated software and weak passwords. Bots constantly scan for sites running plugins or platforms with known, unpatched flaws, and they brute-force common passwords against login pages. Keeping everything updated and using strong passwords with two-factor authentication blocks the large majority of these automated attacks.

How much does website security cost?

The essentials are inexpensive or free: SSL is typically included with hosting, and strong passwords and 2FA cost nothing. A managed maintenance and monitoring plan adds a modest monthly fee for backups, updates and alerts. Either way, prevention is far cheaper than recovering from a breach. See our pricing for details.

Do I need to worry about Canadian privacy laws?

If your website collects personal information such as names, emails or payment details, you have obligations under Canadian privacy legislation like PIPEDA to safeguard that data and, in many cases, report breaches. Following these security basics is a core part of meeting those responsibilities and protecting your customers' trust.