The uncomfortable truth
Almost no small business is hacked by someone who targeted them. They are hacked by automated bots scanning the entire internet for known vulnerabilities that were patched months ago. Which means basic hygiene stops the overwhelming majority of attacks.
The essentials
If you do nothing else, do these six. They stop most automated attacks.
- HTTPS everywhere — free via Let's Encrypt, with automatic renewal and a redirect from HTTP.
- Update everything monthly — CMS core, plugins, themes, server packages. This single habit prevents most compromises.
- Strong, unique admin passwords — in a password manager, never reused from another service.
- Two-factor authentication — on your CMS admin, hosting panel, domain registrar, and email.
- Automated off-server backups — daily, stored elsewhere, and tested by actually restoring one.
- Remove unused accounts and plugins — every dormant plugin and ex-employee login is unnecessary exposure.
Your domain registrar account is the most valuable target you own. Someone who controls your domain controls your website and your email — including password resets for everything else. Enable 2FA and registrar lock on it today if you have not.
For sites handling user data
If customers log in or you store personal information, the bar rises:
- Hash passwords properly Using bcrypt or Argon2, never MD5, never SHA1, never plain text. If your developer cannot tell you which is used, that is your answer.
- Use parameterised queries This eliminates SQL injection, still one of the most common serious vulnerabilities in custom-built Indian websites.
- Escape all output Anything a user submits must be escaped before display, or you have a cross-site scripting hole.
- Validate on the server Browser validation is a convenience for users, not a security control. Attackers skip the browser entirely.
- Rate-limit login and payment endpoints Stops credential stuffing and automated card testing.
- Set secure session cookies HttpOnly, Secure, and SameSite flags, with sessions that actually expire.
Security headers worth adding
| Header | What it prevents | Difficulty |
|---|---|---|
| Strict-Transport-Security | Downgrade to HTTP | Easy |
| X-Content-Type-Options | MIME-type confusion attacks | Easy |
| X-Frame-Options | Clickjacking via iframes | Easy |
| Referrer-Policy | Leaking URLs to third parties | Easy |
| Content-Security-Policy | Cross-site scripting | Harder — test carefully |
The first four are a few lines of server configuration and carry essentially no risk of breaking anything. CSP is more powerful but needs testing, since a strict policy can block legitimate scripts.
Indian data protection obligations
The Digital Personal Data Protection Act creates real obligations for businesses handling personal data. Practical implications:
- Collect only data you genuinely need and can justify.
- State clearly what you collect and why, in a published privacy policy.
- Obtain meaningful consent — pre-ticked boxes do not qualify.
- Provide a route for users to request access to or deletion of their data.
- Be able to detect and report a breach.
- Do not retain personal data indefinitely without a reason.
The cheapest compliance strategy is collecting less data. You cannot leak what you never stored.
Hosting and infrastructure
- Choose a host that patches promptly and supports current PHP versions — cheap shared hosting frequently does not.
- Disable directory listing so your file structure is not browsable.
- Keep configuration files and credentials outside the public web root.
- Never commit passwords or API keys to your code repository.
- Use SFTP or SSH, never plain FTP.
- Consider Cloudflare — its free tier blocks a meaningful amount of automated abuse.
WordPress specifics
WordPress powers a huge share of Indian small business sites and attracts a corresponding share of attacks:
- Never use "admin" as a username.
- Limit login attempts and consider changing the login URL.
- Disable file editing from the dashboard.
- Delete deactivated plugins and themes entirely — deactivated code can still be exploitable.
- Never install nulled or pirated premium plugins. This is one of the most reliable ways to get compromised.
- Install a reputable security plugin, but understand it is not a substitute for updates.
If you are compromised
- Contain it Take the site into maintenance mode to stop harm to visitors.
- Change credentials from a clean device Hosting, CMS, database, email, registrar. Assume everything is exposed.
- Restore from a backup predating the compromise Check backup dates carefully — recent backups may already contain the malicious code.
- Patch the entry point Restoring without fixing the vulnerability means being reinfected within days.
- Scan before relaunch Then request review in Search Console if Google flagged the site.
- Notify affected users If personal data was exposed, you likely have a legal obligation to disclose.
Want a security review of your existing site, or a build that is secure by default? Get in touch. See also our maintenance checklist, which covers the routine work that prevents most incidents.