A secure website comes down to a short list of habits you keep up: strong logins with multi-factor authentication, fast updates, tested backups, HTTPS, a locked-down domain and a plan for when something goes wrong. Most hacked small business sites weren’t targeted personally. They were running an old plugin or an unprotected admin login. This checklist covers what to check, why it matters, and what Australian rules say about it.
TL;DR
-
Turn on multi-factor authentication (MFA) for every admin, hosting and domain account. It’s the single biggest win.
-
Patch fast. The Australian Signals Directorate (ASD) treats critical, actively exploited flaws as a 48-hour job, so don’t leave updates for “next month”.
-
Keep backups off the website’s own server and test a restore at least once.
-
Lock down your domain and email records, and send renewal notices to more than one person.
-
If you hold personal information, know your duties under the Notifiable Data Breaches scheme before you need them.
Table of Contents
Start with a quick audit
Before fixing anything, write down what you actually have. You can’t protect what you’ve forgotten about. Grab a spreadsheet and list:
-
Your domain name, who registered it and which email receives the renewal notices
-
Your hosting provider and the plan you’re on
-
Your website platform (WordPress, Wix, Shopify or custom) and its version
-
Every plugin, app or theme installed
-
Every person with a login, and what level of access they have
-
Where your backups live and when the last one ran
Most businesses find at least one surprise: a former contractor who still has admin access, a plugin nobody uses, or a domain registered under someone’s personal email. That list is the base for everything below.
Lock down logins and access
Stolen or guessed passwords are the easy way in. The Australian Cyber Security Centre’s small business guidance puts turning on multi-factor authentication at the top of its starter list, alongside updating software and backing up. Do this first.
The login checklist
-
Turn on MFA for your website admin, hosting, domain registrar, email and any marketing or payment tools connected to the site.
-
Use a password manager and give every account a unique passphrase. Reusing one password across tools is how a breach somewhere else becomes a breach of your site.
-
Delete the default “admin” username if your platform created one.
-
Give each person their own login. Never share one account between staff.
-
Apply least privilege: a person writing blog posts doesn’t need to install plugins or change settings.
-
Remove access the day someone leaves, including freelancers and past agencies.
-
Limit login attempts, or add a bot challenge on the login page.
The OWASP Top 10 ranks broken access control as the number one web application risk. In plain terms: the site lets someone do something they shouldn’t be allowed to. For a brochure site, that’s mostly about who has admin rights. For a site with customer accounts, bookings or a shop, every action needs a server-side permission check, not just a hidden button. If you’re commissioning a custom build, ask your developer how this is handled. Good answers mention denying access by default.
Keep everything updated
Outdated software is the other big door. Content management systems, themes, plugins and even the code libraries behind your site all get security fixes, and attackers read those fix notes too. Once a patch is public, the clock is ticking.
The ASD’s Essential Eight maturity model sets a useful benchmark. For internet-facing services, it points to patching within two weeks of a fix being released — or within 48 hours once a working exploit exists. Attackers read the fix notes too, so that window closes fast.
Practical update routine
-
Turn on automatic updates for minor releases and security patches where your platform allows it.
-
Check for plugin and theme updates weekly, not quarterly.
-
Delete plugins and themes you don’t use. Deactivating isn’t enough, as the code is still on the server.
-
Replace anything the developer has abandoned. If a plugin hasn’t been updated in two years, find an alternative.
-
Test big updates on a staging copy first if your site takes bookings or payments.
If you run WordPress, this is the part that most often slips. Our WordPress security page explains how we handle updates, hardening and monitoring. Hosted builders like Wix handle platform patching for you, but you’re still responsible for logins, apps you add and the content you publish.
Back up, then prove the backup works
Backups are your answer to ransomware, a botched update, a deleted page or a hacked site. The Australian Cyber Security Centre’s guidance on regular backups frames them as how you recover and keep operating after an incident, and that’s the right way to think about it.
Two rules matter most:
-
Keep a copy somewhere else. A backup stored in the same account as your website can be wiped by the same attacker.
-
Test a restore. A backup you’ve never restored is a hope, not a plan. Do a trial restore to a staging site at least once, and again after any major rebuild.
A sensible rhythm for most small business sites is daily backups for a site that takes orders or form enquiries, and weekly for a mostly static site. Keep several versions, so you can go back past the point where the problem started. If you’re after managed hosting with this built in, see our WordPress web hosting in Wollongong.
HTTPS, headers and the basics of the connection
HTTPS encrypts traffic between your visitor and your site. Browsers flag sites without it as “not secure”, which is bad for trust and for conversions. Most hosts now include a free certificate, so there’s little excuse.
What to check
-
Every page loads on https://, and the http:// version redirects to it.
-
The certificate renews automatically, and you know who gets the warning if renewal fails.
-
No “mixed content” warnings, where an image or script still loads over plain HTTP.
-
HTTP Strict Transport Security (HSTS) is switched on once you’re confident everything works over HTTPS. It tells browsers to never try the insecure version.
-
Basic security headers are set, such as a content security policy and protection against your pages being framed by other sites. Your developer or host can set these, and free online header scanners will show what’s missing.
Don’t treat the padlock as proof your site is safe. The Australian Cyber Security Centre makes the point that certificates are only one piece, and secure habits do more of the work. A site with HTTPS and an unpatched plugin is still an easy target.
Protect your domain and email
Your domain is the one asset you can’t easily replace. If it expires or gets hijacked, your website, email and search rankings go with it.
Domain checklist
-
Register the domain in your business’s name, not an employee’s or web developer’s.
-
Turn on MFA at the registrar and enable registrar lock.
-
Send renewal notices to at least two people, on addresses that don’t depend on the domain itself. The cyber.gov.au guidance warns against relying on a single person for these alerts.
-
Turn on auto-renew, and put the expiry date in a shared calendar anyway.
-
Keep contact details current so you receive warnings.
Email records
Attackers love to send fake emails that look like they come from your business. Three DNS records make that harder: SPF (which servers may send for you), DKIM (a signature proving the message wasn’t altered) and DMARC (what receivers should do when a message fails). The ASD’s guidance on combating fake emails covers all three. If you send invoices or quotes by email, this isn’t optional, since a spoofed invoice can cost your customers real money and cost you their trust.
Secure forms, customer data and your privacy duties
If your site collects names, emails, phone numbers or payments, you’re holding personal information, and that comes with obligations.
-
Collect only what you need. Data you never store can’t be stolen.
-
Send form submissions to a secure inbox or CRM, not just to a shared mailbox with a weak password.
-
Use a reputable payment gateway so card details never touch your server.
-
Publish a privacy policy that matches what you actually do. We’ve written a guide to an APP-compliant privacy policy for Australian websites if you need a starting point.
Notifiable Data Breaches (NDB) scheme
Under the Privacy Act 1988, organisations covered by the Act must tell affected people and the Office of the Australian Information Commissioner (OAIC) when a data breach is likely to result in serious harm. The Act generally covers businesses with annual turnover above $3 million, plus some smaller ones such as health service providers and businesses that trade in personal information. Many small operators fall outside it, but don’t assume. Check the OAIC’s notifiable data breaches pages, and ask your accountant or a privacy lawyer if you’re unsure whether you’re covered.
Even if you aren’t covered, telling customers quickly so they can change passwords is the right thing to do and protects your reputation.
Choose hosting and plugins carefully
Cheap shared hosting can be fine for a small brochure site, but check what you get for the money:
-
Automatic backups, stored separately
-
A web application firewall or malware scanning
-
Support for current PHP versions if you use WordPress
-
Isolation between accounts, so a neighbour’s hacked site doesn’t spread to yours
-
A clear support path when something breaks at 7 pm on a Friday
For plugins and apps, install from reputable sources only, favour actively maintained ones, and keep the number low. Every extra piece of code is something to patch. Pirated or “nulled” premium plugins are a classic way to get malware onto a site.
Speed and security also overlap. A lean site with fewer bloated add-ons loads faster and has less to attack. If your site feels slow, our speed optimisation is $79 per year.
Build a security habit across your team
Tools only go so far. Staff clicking a dodgy link or reusing a password is how many incidents begin. A short, regular routine helps: a 15-minute review each month of who has access, what’s out of date and whether the last backup ran.
If you’d like a structured view of how your team currently uses technology and where the risks sit, an AI readiness assessment for Australian and New Zealand businesses gathers anonymous staff feedback and turns it into a scored report with a 90-day action plan. It’s a handy way to spot gaps in tools and habits that a technical scan won’t show.
Monitor, and know what you’ll do when it goes wrong
A checklist reduces risk. It doesn’t remove it. Plan for the bad day:
-
Monitor. Use uptime monitoring and malware scanning, and set up Google Search Console so Google can alert you to security issues.
-
Write a one-page response plan. Who to call, who has hosting and domain logins, where backups are.
-
Contain. Change passwords, force logouts, take the site offline if needed.
-
Restore. Roll back to a clean backup, then patch the hole that let them in. Restoring without patching just invites a repeat.
-
Assess and notify. Work out what data was involved and whether the NDB scheme applies.
-
Report. You can report cybercrime through ReportCyber, run by the Australian Cyber Security Centre.
A hacked site often drops out of search results or shows warnings to visitors. That’s one reason security belongs in your SEO thinking too. Small technical changes can swing rankings more than people expect, as we explain in small site changes and big SEO ranking shifts. Security also feeds into whether visitors trust you, which we cover in why web design affects trust.
Our view: Security is maintenance, not a project
We’ve been building and looking after websites for 12 years from Wollongong, and the pattern is consistent. Sites rarely get compromised by something clever. They get compromised because a plugin sat unpatched, a former developer’s login was never removed, or the only person who knew the hosting password left the business.
So we push clients away from the idea of “getting the site secured” as a one-off task. A secure site is one where someone owns the monthly routine. That’s why we like flat, predictable pricing for ongoing care rather than surprise call-out fees, and why we don’t lock people into long contracts. If we’re doing a good job, you’ll stay because the site stays healthy, not because you’re stuck.
If you’re migrating or rebuilding, it’s also the cheapest time to fix security. Clean out old users, retire dead plugins, set up MFA and backups properly from day one. Our website migration page covers how we handle a move without dragging old problems along.
Want a hand with it?
If you’d rather not run this checklist yourself, we can. Our website design starts with a Wix build at $590 one-off, and our SEO Essentials plans start at $170 per month. We can also look after your WordPress updates, backups and hardening. Get in touch through cantydigital.com.au and tell us what you’re running.
FAQs
How often should I run through a website security checklist?
Do a quick check monthly: users, updates and the last backup. Do a fuller review every quarter, including a test restore, DNS records and domain contacts. Run it again after any redesign, platform change or staff departure.
Is a Wix or Squarespace site automatically secure?
Hosted builders look after platform patching and certificates, which removes a lot of risk. You’re still responsible for strong logins, MFA, who has access and any third-party apps you add. Domain security and email records also sit with you.
What’s the most important thing on the list?
MFA on your admin, hosting, domain and email accounts. It blocks most attacks that rely on stolen or guessed passwords. Updates and tested backups are next.
Does my small business have to report a data breach?
It depends. The Notifiable Data Breaches scheme generally applies to businesses covered by the Privacy Act 1988, which includes most with turnover above $3 million and some smaller ones, such as health providers. If you’re not sure, check the OAIC’s guidance or ask a privacy lawyer. Telling affected customers early is sensible either way.
Can a hacked website hurt my Google rankings?
Yes. Compromised sites can be flagged with warnings, have spam pages injected or be removed from results until cleaned. Fixing the hole and requesting a review through Google Search Console is the usual path back.