Website Security Checklist: How to Protect Your Business Website from Hackers

Most business owners only think about website security on the morning their site starts redirecting visitors to a gambling page, or when Google shows a red "This site may be hacked" warning next to their brand name. By then the damage is already done: lost enquiries, a confused sales team, nervous customers and, sometimes, a hosting account suspended without notice.

The uncomfortable truth is that most hacked business websites are not targeted by a hacker who has studied the company. They are found by automated bots that scan thousands of sites every hour looking for one thing: an outdated plugin, a weak password, an exposed admin page or a forgotten test folder. A manufacturer in Vatva GIDC and a boutique in Gandhinagar are equally visible to them.

The good news is that the same automation that makes attacks cheap also makes them predictable. If you close the common doors, you remove yourself from the easy-target list. This checklist walks you through those doors one by one, in plain language, so you can either work through it yourself or know exactly what to ask your developer or maintenance partner.

Why Small and Mid-Sized Business Websites Get Hacked

Before the checklist, it helps to understand what attackers actually want from a typical business website. It is rarely your data alone. More often they want your server's resources and your domain's reputation.

• SEO spam: Hidden pages or links injected into your site to promote pharmacy, betting or counterfeit products, borrowing the trust Google already gives your domain.
• Redirect malware: Visitors from Google or mobile devices are silently sent to scam pages, while you (logged in as admin) see a perfectly normal site.
• Email abuse: Your server is used to send bulk spam, which gets your domain blacklisted and pushes your genuine quotations into clients' spam folders.
• Form and payment skimming: On ecommerce sites, scripts that copy customer details as they are typed into checkout forms.

Notice that none of these require the attacker to care who you are. That is exactly why "we are too small to be hacked" is the most expensive assumption a business owner can make.

Layer 1: Access Control and Passwords

The majority of break-ins start with a login. Either a password is guessed, reused from another breached service, or shared so widely that nobody remembers who has it.

Use unique, long passwords for every access point

Your website has more doors than the admin login. There is the hosting control panel (cPanel, hPanel or similar), FTP or SFTP accounts, the database user, your domain registrar account and every email inbox connected to the site. Each needs its own strong password, ideally generated and stored in a password manager rather than an Excel sheet on the office computer.

Turn on two-factor authentication everywhere it is offered

Two-factor authentication (2FA) means that even if a password leaks, the attacker still needs a one-time code from your phone. Enable it on your domain registrar, hosting account, website admin and the email address used for password resets. The registrar matters more than most people realise: whoever controls your domain controls your website and your email.

Practise least privilege

Not every person needs administrator access. A content writer needs an editor or author role. A freelance designer who worked on your site two years ago needs no access at all. Review user accounts every quarter and remove anyone who has left the company or finished their project.

Protect the login page itself

Limit login attempts, add a CAPTCHA, and consider changing the default admin URL so bots stop hammering it. For custom PHP sites, OTP-based admin login is a strong option because there is no static password to steal in the first place.

Layer 2: Updates, Plugins and Code Hygiene

If passwords are the front door, outdated software is the broken window at the back. Content management systems like WordPress are secure at their core when kept updated; most compromises come through themes and plugins that were never updated after the site launched.

• Update the core, themes and plugins regularly, but take a backup first and test on a staging copy for important sites.
• Delete what you do not use. A deactivated plugin is still code sitting on your server. If it has a vulnerability, it can still be exploited.
• Avoid nulled or "free premium" themes and plugins. Pirated versions downloaded from random sites very frequently contain backdoors. The few thousand rupees saved on a licence can cost far more in cleanup.
• Check the update history before installing anything new. A plugin not updated in a year or more is a warning sign.
• Keep the server's PHP version current through your hosting panel. Old PHP versions stop receiving security fixes.

For custom-coded websites, code hygiene matters even more because there is no community patching your code. Forms should validate and sanitise every input, database queries should use prepared statements to block SQL injection, file uploads should be restricted by type and size, and error messages should never reveal file paths or database details to visitors. If your site was built by a developer who is no longer reachable, a code review by a professional web development team is a worthwhile one-time investment.

Layer 3: Hosting, Server and File Security

Your website is only as secure as the environment it lives in. Very cheap shared hosting often packs many accounts onto one server, and weak isolation means a neighbour's infection can sometimes affect you.

Choose hosting with security basics included

Look for a provider that offers free SSL, a web application firewall (WAF), malware scanning, automatic daily backups, and the ability to choose PHP versions.

Lock down files and folders

Correct file permissions prevent attackers from writing malicious code into your files. As a general rule, folders are set to 755 and files to 644, with sensitive configuration files tighter still. Disable directory listing so visitors cannot browse your folders, and block direct access to configuration files through your server rules.

Clean up the leftovers

Old test folders like /old-site, /backup or /demo, forgotten database dumps, and installer scripts are among the most common entry points we see during cleanups. If it is not part of the live site, remove it from the public server.

Layer 4: SSL, Firewalls, Monitoring and Backups

SSL and firewalls

An SSL certificate (the padlock and "https" in the browser bar) encrypts data travelling between your visitor and your server. It is no longer optional: browsers label non-SSL sites as "Not secure", which immediately damages trust on enquiry and checkout pages. Make sure every page, image and script loads over https, and that the http version redirects automatically.

A web application firewall sits in front of your website and filters malicious traffic such as known attack patterns, bad bots and brute-force login attempts before they reach your site. It can be provided at the DNS level, by your host, or through a security plugin.

Monitoring

Monitoring is the layer most businesses skip. You want to know about a problem before your customers do:

• Uptime monitoring that alerts you if the site goes down.
• Google Search Console verified for your domain, so you receive Google's security issue alerts by email.
• File change monitoring that flags unexpected modifications to core files.
• Periodic malware scans, both from inside the server and from external scanners.

Backups that actually work

A backup is your insurance policy, but only if it can be restored.

A sound backup routine follows a simple principle: multiple copies, in more than one location, with at least one copy stored off the server. For a typical business website that means automated daily or weekly backups (depending on how often content changes), a full backup of both files and database, an off-site copy on cloud storage, and a test restore at least twice a year.

The Complete Website Security Checklist

Use this table as a quarterly review. Mark each item and assign an owner, whether that is you, your in-house team or your maintenance partner.

Area	Checklist item	How often
Access	Unique strong passwords for admin, hosting, FTP, database, registrar	Review quarterly
Access	2FA enabled on registrar, hosting, admin and recovery email	Once, then verify
Access	Remove unused or ex-employee user accounts	Quarterly
Software	Core, theme, plugins and PHP version up to date	Monthly or as released
Software	Unused and nulled plugins or themes deleted	Quarterly
Server	Correct file permissions; directory listing disabled	After every migration
Server	Old test folders, dumps and installer files removed	Quarterly
Encryption	SSL active on all pages; http redirects to https	Check before renewal
Protection	Firewall and login attempt limits active	Once, then verify
Monitoring	Uptime alerts and Search Console security emails set up	Once, then verify
Backups	Off-site backups of files and database; test restore done	Daily/weekly; restore twice a year
Forms	CAPTCHA or spam protection on all forms	Once, then verify

What to Do If Your Website Is Already Hacked

If you see strange redirects, unknown pages in Google results, a warning in Search Console, or a hosting suspension notice, stay calm and act in the right order:

1. Do not delete everything in panic. You need the infected files to understand how the attacker got in.
2. Change every password from a clean device: hosting, admin, FTP, database and email.
3. Take a snapshot of the current state for investigation.
4. Identify the entry point, whether that is a vulnerable plugin, a leaked password or an exposed file. Cleaning without closing the entry point means reinfection within days.
5. Clean files and the database thoroughly, including hidden admin users and injected scripts stored in database tables.
6. Harden the site using the checklist above.
7. Request a review in Google Search Console once the site is clean, and check email blacklists if spam was being sent.

Frequently Asked Questions

Is a WordPress website less secure than a custom PHP website?

Not inherently. WordPress core is well maintained; risk mostly comes from outdated or poor-quality plugins and themes. A custom PHP site has a smaller attack surface but depends entirely on the quality of its code. Either can be very secure with proper development and ongoing maintenance.

Does an SSL certificate mean my website cannot be hacked?

No. SSL encrypts data in transit between the visitor and your server. It does not protect against weak passwords, vulnerable plugins or malicious uploads. It is one essential layer, not the whole wall.

How much does website security cost for a small business in India?

Basic hardening such as strong passwords, 2FA and SSL costs little or nothing. Firewalls, premium security tools and managed maintenance plans add cost that varies with site size and complexity. In most cases, prevention costs far less than an emergency cleanup plus the lost enquiries during downtime.

How often should my website be backed up?

It depends on how often it changes. Ecommerce and frequently updated sites need daily database backups; brochure sites can usually manage with weekly backups plus one before every update. Always keep at least one copy off the server.

Can I handle website security myself?

Many items on this checklist, such as passwords, 2FA and user reviews, are easy to do yourself. Server hardening, code review and malware cleanup usually need technical expertise. Many businesses handle the basics in-house and hand over the rest to a maintenance partner.

Make Security a Routine, Not a Rescue

Website security is not a one-time setup; it is a habit. A few minutes of attention every month, a quarterly review of this checklist, and reliable off-site backups will keep your website off the easy-target list and keep your enquiries flowing.

If you would rather focus on running your business, Lionic Digital's website support and maintenance service covers updates, backups, monitoring and hardening for business websites across Ahmedabad, Gujarat and India. Already facing a hacked site? Get in touch with our team and we will help you clean it up and close the door behind it.