Small business websites are rarely attacked by someone who has chosen them personally. Most attacks are automated: tools that scan thousands of websites looking for weak passwords, outdated plugins and unprotected forms. You do not need a security team to avoid most of these problems. You need a few good habits, applied consistently.
In this guide
1. Use HTTPS everywhere
HTTPS encrypts information sent between visitors and your website and shows the padlock in the browser. Shopify and most modern hosts provide free SSL certificates. Make sure every page loads over HTTPS, that old http:// links redirect automatically, and that images and scripts are not loaded over plain HTTP, which causes browser warnings.
2. Protect every login
Your website is only as secure as the accounts that control it: website admin, hosting, domain registrar and email.
- Use a long, unique password for each account. A password manager makes this practical.
- Turn on two-step verification wherever it is offered.
- Do not share your main login. Give staff and freelancers their own accounts with only the permissions they need.
- On Shopify, developers can request access through collaborator accounts instead of using your password.
- Remove accounts for people who no longer work with you.
3. Keep software updated
On WordPress and other self-hosted platforms, outdated plugins and themes are a leading cause of hacked websites. Apply updates regularly, ideally after taking a backup, and delete plugins and themes you no longer use rather than leaving them deactivated.
Hosted platforms (e.g. Shopify)
- Platform and servers updated for you
- You manage apps, staff accounts and theme code
- Fewer moving parts to maintain
Self-hosted (e.g. WordPress)
- You update core, theme and plugins
- Hosting security varies by provider
- Unused plugins should be deleted
4. Back up your website
Keep regular backups stored somewhere other than your website server, and test that you can actually restore them. A backup you have never restored is a hope, not a plan. On Shopify, export your products and customers periodically and keep copies of your theme, because accidental changes and deletions by staff or apps are your responsibility to recover from.
5. Protect your forms from spam
Contact forms attract automated spam. Use a hidden honeypot field, rate limiting or a CAPTCHA service. Validate inputs so forms only accept the type of data you expect, and never ask for passwords or payment details through a general contact form.
6. Lock down your domain
Secure your domain registrar account with two-step verification, enable the registrar transfer lock, and turn on auto-renewal. An expired domain can be registered by someone else, taking your website and email with it. More on this in How to Choose a Domain Name for a Business.
7. Secure your business email
Set up SPF, DKIM and DMARC records for your domain. These help prevent criminals from sending email that appears to come from your address, and improve delivery of your genuine emails. Your email provider's help pages explain the exact records to add.
8. Watch for phishing
Many website takeovers start with a fake email that looks like it comes from your platform, bank or domain provider, often warning that your account will be suspended. Do not click login links in unexpected emails. Open the website directly in your browser and check from there.
Warning signs: urgent deadlines, requests to "verify" your password, slightly misspelled sender addresses, and links that point to a different domain when you hover over them.
A monthly security routine
- Review user accountsRemove anyone who no longer needs access.
- Apply updatesFor self-hosted sites, update core, themes and plugins after a backup.
- Check backupsConfirm they ran and occasionally test a restore.
- Check expiry datesDomain renewal and SSL certificate status.
- Review apps and pluginsRemove anything unused.
What to do if your website is hacked
- Change all passwords and enable two-step verification on every account.
- Contact your hosting or platform support.
- Restore from a clean backup if needed.
- Find and fix how the attacker got in, for example an outdated plugin, before going live again.
- If customer data may have been exposed, seek advice on your obligations to inform them.
Frequently asked questions
Is Shopify more secure than WordPress?
Shopify handles server and platform security for you, which removes many common risks. A well-maintained WordPress site can also be secure, but it requires more ongoing work from the owner.
Do I need a paid security plugin?
Not always. Strong passwords, two-step verification, updates and backups prevent most problems. A reputable security plugin can add useful protection on WordPress.
How often should I change passwords?
Use long, unique passwords and change them immediately if there is any sign of compromise or when someone with access leaves.
