Website Security Basics: SSL, HTTPS, and Keeping Your Site Safe

Most small business owners think about website security exactly once — when something goes wrong. By then the options are bad: a site serving malware, a hosting account suspended, a “Not secure” warning scaring away customers, or in the worst cases, customer data exposed.

The good news is that the fundamentals are genuinely simple. You don’t need to understand cryptography. You need to get a short list of things right and then leave them alone.

Start with HTTPS, because it’s visible

What the padlock actually means

When you visit a site over HTTPS, everything between the visitor’s browser and your server is encrypted. Someone intercepting the connection (on café wifi, on a compromised router, at an ISP) sees scrambled data instead of readable content.

Over plain HTTP, that same traffic is readable by anyone positioned to look. Every form submission, every page, in plain text.

The padlock in the address bar means the encryption is active and the certificate is valid.

Why it matters even without a checkout

The common objection: “I don’t take payments on my site, so who cares?”

Three reasons it still matters:

Browsers actively warn people. Chrome, Safari, and Firefox all mark HTTP pages as “Not secure.” On a page with a form, some show a harder warning. For a business selling professional services, a browser telling visitors your site isn’t safe is a conversion problem regardless of what data you handle.

It’s a confirmed ranking signal. Google has used HTTPS as a lightweight ranking signal since 2014. Small, but real, and free.

Your contact form is data. Names, phone numbers, email addresses, and whatever people type into “tell us about your project.” Over HTTP that travels in the clear.

Certificates are free

Charging for a basic SSL certificate is charging for something that costs the provider nothing. Let’s Encrypt (a nonprofit certificate authority) made them free and automatic years ago, and effectively every serious host now includes SSL at no cost.

If your host wants an annual fee for basic SSL, that’s a signal about the host.

The paid tiers (Organisation Validated, Extended Validation) verify your legal business identity rather than just domain control. Browsers no longer display any special indicator for them. For a small business site, the free certificate is the correct choice.

Having a certificate isn’t enough

This is where sites quietly fail. Installing a certificate makes HTTPS available. It doesn’t make it used.

If http://yoursite.com still loads over plain HTTP and returns a normal page instead of redirecting, then:

• Visitors who type your address without https:// get the insecure version
• Old links keep pointing at HTTP
• Google may index both versions as separate URLs — duplicate content
• The padlock never appears for those visitors

Test it right now. Type http:// in front of your domain. You should be redirected to https:// immediately, with a padlock. If the page loads and stays on http://, that’s a live problem.

The fix is a permanent (301) redirect from HTTP to HTTPS. Most hosts and CDNs have a one-click setting — on Cloudflare it’s SSL/TLS → Edge Certificates → Always Use HTTPS.

Mixed content

A subtler failure: the page loads over HTTPS but pulls an image, script, or stylesheet over HTTP. Browsers either block the resource or downgrade the padlock.

Usually it’s an old hardcoded http:// URL in a template or a post. Your browser’s developer console flags these explicitly.

The rest of the essentials

HTTPS is the visible part. These are the ones that actually prevent incidents.

Keep software updated

The overwhelming majority of small business site compromises exploit known vulnerabilities in outdated software. Not sophisticated attacks — automated scanners looking for versions with published exploits.

If you’re on WordPress, this is your single biggest risk surface: core, themes, and every plugin. Each is a separate thing to keep patched, and abandoned plugins are the classic entry point.

Practical rules:

• Turn on automatic updates for security patches
• Delete plugins and themes you don’t use — inactive code is still exploitable
• Before installing anything, check when it was last updated. Two years is a red flag
• Fewer plugins is better security, not just better speed

This is one of the real tradeoffs in WordPress versus a custom build. A static site has almost no attack surface because there’s no database and no server-side code to exploit.

Use real passwords and two-factor authentication

Credential stuffing (trying leaked username/password pairs across many sites) is entirely automated and constant.

• A password manager, unique passwords everywhere
• Two-factor authentication on hosting, domain registrar, CMS, and email
• No shared logins; separate accounts per person
• Remove access the day someone stops working with you

Your domain registrar and email deserve the most protection. Domain access means someone can point your website anywhere. Email access means they can reset every other password you own.

Take backups you’ve actually tested

Backups are what turn a catastrophe into an afternoon.

• Automatic, daily
• Stored somewhere other than the server they’re backing up — a backup on a compromised server is compromised too
• Retained at least 30 days, because problems aren’t always noticed immediately
• Restore one, once a year. An untested backup is a hope, not a plan

Limit who has access

Not everyone needs administrator rights. Most CMSs have roles — use them. A contractor writing blog posts needs to write blog posts.

Put something in front of the site

A CDN or web application firewall filters obvious attack traffic before it reaches your server. Cloudflare’s free tier includes basic protection, DDoS mitigation, and a certificate. For most small business sites this is enough and costs nothing.

Secure headers

A few HTTP headers meaningfully reduce risk:

• Strict-Transport-Security — tells browsers to only ever use HTTPS for your domain
• X-Content-Type-Options: nosniff — stops browsers guessing file types
• X-Frame-Options — prevents your site being embedded in someone else’s page
• Referrer-Policy — controls what’s leaked when visitors click away

These are a few lines of configuration and are set once.

Protect the domain and the email too

Website security discussions usually stop at the website. Two adjacent things matter as much.

Domain

• Two-factor authentication on the registrar
• Registrar lock enabled, preventing unauthorised transfers
• Auto-renew on, with a payment method that isn’t expired

Expired domains are one of the most common and most avoidable disasters. The site vanishes, email stops, and recovery can be expensive or impossible if someone else registers it.

Email authentication

If your domain isn’t configured to say who may send email as you, anyone can forge your address. Three DNS records fix this:

• SPF — lists which servers may send mail for your domain
• DKIM — cryptographically signs your outgoing mail
• DMARC — tells receiving servers what to do with mail that fails the first two

Without these, someone can send invoices to your customers from an address that looks exactly like yours. With them, those messages get rejected or quarantined.

If your domain doesn’t send email at all, publish records saying exactly that — it’s the strongest possible protection against being impersonated.

Signs something is already wrong

• Google Search Console sends a security notification — take this seriously and immediately
• Your site redirects somewhere unexpected, sometimes only for mobile or only from search
• Pages appear in Google you never wrote, often about pharmaceuticals or gambling
• The site suddenly gets much slower
• Your host suspends the account
• New admin users you didn’t create

If any of these appear: take the site offline rather than leaving it serving malware, change every password from a different device, restore from a backup predating the problem, patch whatever got in, then request a review in Search Console.

A realistic maintenance rhythm

Monthly — apply updates, check Search Console for security notices, confirm backups ran.

Quarterly — review who has access and remove anyone who shouldn’t. Check SSL is valid and renewing. Confirm the HTTP→HTTPS redirect still works.

Annually — restore a backup to a staging site and verify it works. Review the plugins you’re carrying. Check domain expiry and registrar lock.

That’s roughly two hours a year. We go deeper on the operational side in website maintenance and security.

Frequently asked

Do I need to pay for an SSL certificate? No. Free certificates from Let’s Encrypt are cryptographically identical to paid ones and every serious host includes them. Paid tiers verify your legal identity rather than just domain ownership, and browsers no longer display any difference.

My site is small. Is anyone really targeting it? Nobody is targeting you personally. Automated scanners sweep the entire internet looking for known vulnerable software versions, and they don’t care how many visitors you get. Being small is not protection.

What happens if my certificate expires? Visitors get a full-page browser warning telling them the site may be unsafe, and most turn back. Modern certificates renew automatically, so this only happens when something is misconfigured. Worth checking once a year.

Is WordPress inherently insecure? No, but it has a much larger attack surface than a static site: core, themes, and every plugin are separate things to keep patched. Well-maintained WordPress is fine. Neglected WordPress is where most compromises happen.

Do I need a security plugin? It helps on WordPress, though it’s no substitute for updates and strong passwords. A CDN with a firewall in front of the site usually does more.

Someone told me my site has malware. How do I check? Look in Search Console first, under Security & Manual Actions, since Google will tell you directly. Then check whether pages you didn’t write appear when you search site:yourdomain.com.

How often should I really be doing this? Updates monthly, access review quarterly, a restore test once a year. That’s around two hours annually, which is a small price for not losing the site.

Is my email as important as my website? More so, in one respect. Email access lets someone reset the passwords on everything else you own, including your domain and hosting.

Six things, done once

• HTTPS everywhere, with HTTP redirecting to it — certificates are free, so there’s no excuse
• Update software, or run a site with less software to update
• Unique passwords and 2FA, especially on the domain and email
• Tested backups, stored somewhere else
• Least privilege — fewest people with the fewest rights
• Protect the domain and email, not just the website

None of this requires expertise. It requires doing six things once and checking them occasionally.

---

Not sure where your site stands? Every site we build ships with HTTPS, security headers, automatic backups, and a maintenance plan that keeps it that way, and you own all of it. See how we work or get a free quote.