Attackers rarely target a small business by name; they simply find neglected sites. Three routine habits that make a website a far harder target.
Article:
Owners of small businesses often assume that attackers pursue only large organisations. Automated tools do not discriminate. They scan the internet for known weaknesses and act on whatever they find, which means a modest website running outdated software is simply an easier target than a well-kept one.
Updates are the first line of defence
Website platforms, themes and add-ons regularly publish fixes for weaknesses that have come to light. Each week that a fix goes unapplied is a week in which the flaw is publicly documented and freely exploitable. A monthly routine for applying updates is far better than an occasional flurry of effort. It is also worth removing any theme or add-on that is no longer used, since every inactive component remains a possible way in.
Access is a people problem
Many breaches begin with an ordinary lapse rather than clever technique: a password shared among colleagues, an account belonging to a contractor who left two years ago, administrator rights granted for convenience and never withdrawn. Give each person their own login, use a password manager to generate distinct passwords, and switch on two-step verification wherever it is offered. Once a quarter, review the list of users and remove anyone who no longer needs access.
Backups only count if they restore
A backup stored on the same server as the website offers little comfort if that server fails. Keep copies in a separate location, and, just as importantly, test them. A backup that has never been restored is a hope rather than a plan. The test need not be elaborate; recovering the site to a temporary address once or twice a year will reveal most problems.
Finally, confirm that the site is served over HTTPS and that the certificate renews automatically. Browsers now display warnings on sites that lack it, and visitors take those warnings seriously.
None of these measures depend on specialist knowledge, but they do depend on someone owning them. When appointing a website development company to build or rebuild a site, it is reasonable to ask who will handle updates, access and backups after launch, and to have the answer in writing.
Security is rarely dramatic. It is a matter of small, repeated habits that make a site tedious to attack, and tedium is precisely what discourages an opportunistic intruder.
Sign in to leave a comment.