SSL, HTTPS and the Security Basics Every Site Needs

Most attacks on small business sites aren't targeted. Automated scanners look for known weaknesses across thousands of sites, and take whichever ones are easy. The goal isn't to be impenetrable — it's to not be the easy one.

HTTPS everywhere, no exceptions

Certificates are free now, so there's no reason for any page to be unencrypted. Redirect all HTTP traffic to HTTPS and set the certificate to renew automatically — an expired certificate makes your site look broken and untrustworthy to every visitor.

The short list

• Keep the framework, plugins and server packages updated
• Two-factor authentication on every admin account
• Rate-limit the login page against password guessing
• Never store passwords in plain text — hash them properly
• Automated backups, stored somewhere other than the same server
• Remove old admin accounts when staff leave

The uploads folder deserves attention

If users can upload files, validate the type properly on the server and store them where they cannot be executed. An uploads directory that will run a script is one of the most common ways sites get taken over.