Q&A › Security & backups
What actually gets small business sites hacked, what a backup is worth, and the boring habits that prevent most of it.
Nobody targets a nail salon specifically. Automated scanners target every site on the internet, which includes yours.
Nobody chooses you. Automated scanners try every known weakness against every address they can find, looking for a machine to send spam from or a page to hide links on. It is weather, not a grudge, which is why the ordinary precautions work.
Out-of-date software, reused passwords, and old plugins nobody maintains. Sophisticated attacks are rare at this level. Keeping things updated and using a password manager prevents the overwhelming majority of it.
A second step after the password, usually a code on your phone. Yes. It is the single highest-value thing on this page and it takes two minutes. Turn it on for your domain registrar, your hosting and your email first.
It depends on how often it changes and how much you would accept losing. A site that changes monthly does not need hourly backups; a shop taking orders does. The question to ask any provider is not how often they back up but how quickly they can restore.
A web application firewall — a filter in front of your site that blocks known attack patterns before they arrive. Worthwhile for anything with logins or payments. Not a substitute for updating your software, which is where the actual holes are.
The card industry's security rules. If you use a proper payment processor and card details never touch your own server, your obligations are modest. If you were planning to store card numbers yourself, do not — the requirements are serious and the liability is yours.
Take it offline rather than leave it serving malware, change every related password from a clean device, and restore from a backup made before the compromise. Then find how they got in — restoring without fixing the hole just repeats the week.
Not inherently, but it is the most attacked because it is the most used, and its plugin ecosystem is uneven. A well-maintained WordPress site is fine. An abandoned one with eleven plugins last updated in 2021 is a liability.
If you collect anything, including through a contact form or analytics, you should have one, and in California you likely must. It needs to describe what you actually collect, which means writing it after the site is built rather than pasting a template.
Elsewhere in the guide
Let’s build something great
Custom digital solutions. Real growth. Lasting results.
INNOVATIVE MEDIA DEVELOPMENT GRAPHIC