A customer clicks through to your site and sees a "not secure" warning in the address bar. Most people close the page at that moment. They don't come back to book an appointment, ask for a quote or leave their details. And you can't work out why the phone has stopped ringing.
Security often feels "technical and far away" to business owners. But the real issue is trust: your customer should be able to trust you when they leave their details on your site. In this article I explain website security from a business owner's point of view. You don't need to know code or tools. You just need to know what to look at and what to ask of the person who looks after your site.
What does the padlock in the address bar mean?
If you see a small padlock at the start of your site's address, the connection between the visitor and your site is encrypted. What provides this is called an SSL certificate. In short, it makes sure the details your customer types can't be read by someone else on the way. It is like sending a letter in a sealed envelope instead of an open postcard.
Without the padlock, the browser may show a "not secure" warning. However good your site looks, that warning spoils the visitor's first impression. Google also cares about secure connections, so a missing padlock can hurt your visibility too.
The good news is that this is usually solved with a free or low-cost certificate, and most hosting companies set it up. What matters is that the certificate doesn't expire. If it does, the warning comes back.
What you can check yourself
You can check the following without any technical knowledge:
- The padlock: open your site on your phone and on your computer. Is there a padlock in the address bar, or does a warning appear?
- Your passwords: is your site's admin password used anywhere else? Is it something guessable, like a birthday, a phone number or "123456"?
- The access list: do you know who can log into your site and with what level of permission?
- The last update: ask when the site was last updated.
- A form test: fill in your contact form yourself and see whether the message reaches you.
Passwords and access: the most common weak spot
The security problem I see most often with my clients isn't a complicated attack. It's a weak or shared password. A password should be personal, long and not used anywhere else. Because remembering many passwords is hard, using a trusted password manager is a sensible solution.
Access matters just as much. A web designer, a former employee, an intern, an advertising agency. Over time the number of people who can enter your site grows, and most keep their access after the job is done. Each person should have only the permission they need, and access should be closed when the work ends. Instead of everyone sharing one account, everyone should have their own, so that when something goes wrong you can see who did what.
A site that is kept up to date
Sites run on software that ages over time. When software makers find a security hole, they release an update. If you don't update, the hole stays there as a door everyone knows about.
Think of the lock on your front door. If the maker announces that a certain model is easy to open and you haven't replaced it, you are relying on luck. Updating is a specialist's routine job. Yours is to make sure it is done regularly.
The question to ask is simple: "When was my site's software last updated, and who keeps track of it?" If the answer is "I don't know" or "never", that is a warning sign. A written maintenance agreement stating how often updates happen and who to contact prevents most surprises.
Customer details from your contact form
Names, phone numbers and messages that arrive through a contact or booking form are personal data. If you work with European customers, protecting them may be a legal obligation under data protection rules.
Ask the person doing the work:
- Where do the form details go, and who can see them?
- Are they kept on the site or in email for longer than necessary?
- Does the form include consent for collecting personal data and a privacy notice?
For legal advice, talk to a lawyer.
How do you tell if a site has been attacked?
The signs are usually these:
| Sign | What it may mean |
|---|---|
| A page or article on your site you don't recognize | Someone may have added content without permission |
| Your site's title looks strange in Google | The site may have been changed with bad intent |
| Visitors are sent to another site | The site may have been taken over |
| The browser or Google shows a "dangerous site" warning | Harmful content may have been detected |
| Changes in the admin area that you didn't make | Your account may be in someone else's hands |
First steps
If you suspect something like this, stay calm and follow this order. First, call the person who built the site or your hosting company straight away. Then change your passwords, ideally from a different device. Next, ask when the last backup was taken. Finally, if customer data may be affected, record the situation in writing. Don't try to delete files yourself, because you may destroy evidence and the traces needed for cleaning up.
The specialist does the cleaning. They find and remove the harmful content, work out how the intruder got in, restore the site from a clean backup and, if needed, tell Google it has been cleaned. The time varies from a few hours to a few days depending on the scale. Ask for a report at the end: what happened, where the entry point was, what was done and how a repeat will be prevented.
Frequently asked questions
I run a small business. Would anyone attack my site?
Most attacks don't target a particular person. Automated programs scan the internet for weak sites, so small sites are at risk too.
Does the padlock make my site completely safe?
No. The padlock only encrypts the connection. Passwords, updates and access management matter just as much.
If my site is hacked, will it be removed from Google?
If harmful content is detected, Google may show a warning next to your site and your ranking can drop. Once the site is cleaned and Google is informed, the warning goes away. It isn't possible to say in advance how long recovery will take.
How often should security be checked?
Updates and checks should be regular. A monthly maintenance agreement, or a check a few times a year, is enough for most small businesses.
Next step
Security is not something you do once and forget; it is a habit that needs regular care. Check today whether your site has the padlock, write down your access list and talk through any gaps with the person who looks after your site. If you would like a site built with security in mind from the start, see my website design page.