You don't need a dedicated IT team to cover the security basics. Most common attacks exploit straightforward misconfigurations that can be checked and fixed in an afternoon.
1. HTTPS everywhere
Every page should be served over HTTPS. If any content still loads over HTTP, or your certificate has expired, browsers show warnings that drive visitors away. Most hosting providers offer free SSL via Let's Encrypt. There's no excuse for running HTTP in 2024.
2. Security headers
Your web server should send headers telling browsers to apply additional protections:
- Content-Security-Policy — restricts which resources browsers can load
- Strict-Transport-Security (HSTS) — forces browsers to always use HTTPS
- X-Frame-Options — prevents your site from being loaded inside an iframe (clickjacking)
- X-Content-Type-Options — stops browsers from guessing file types
These are configuration changes, not code changes.
3. Email authentication (SPF, DKIM, DMARC)
Without these three DNS records, anyone can send email pretending to come from your domain. Your email provider (Google Workspace, Microsoft 365) will have setup documentation.
4. Keep everything updated
If you run WordPress, keep it and every plugin and theme updated. The majority of site compromises exploit known vulnerabilities in outdated software for which patches already exist.
5. Remove what you don't need
Unused plugins, old admin accounts, staging files, backup archives left on the live server — each one is potential attack surface.
6. Strong credentials and 2FA everywhere
Admin passwords should be long and unique. Enable two-factor authentication on your hosting panel, CMS, and domain registrar.
7. Regular backups stored offsite
Automate backups of your site and database, stored off the same server. Test restoring from backup occasionally.
8. Know what's exposed
Run a security scan to see your site from an attacker's perspective — what files are accessible, what headers are missing, whether your domain is blocklisted.
threatprobe.app's free scan covers all of the above in ~15 seconds. No registration required.