Most small business owners picture website security as something out of a heist film — a sophisticated hacker specifically targeting them. In practice, almost none of it looks like that. It’s automated bots scanning thousands of sites for the same handful of easy openings: weak passwords, out-of-date software, forms with no spam protection. None of the fixes below need technical skill — they’re mostly about closing obvious doors, not building a fortress.
Passwords and who has access
The single biggest security hole on most small business sites is login access nobody’s audited in years. Worth doing right now:
- Check who actually has admin access — a past employee, an old contractor, a developer you haven’t worked with since 2023. If they don’t need it, remove it.
- Use a password manager, not a password you can remember — “remember-able” and “secure” are opposites, and the same password reused across your email, hosting, and site login means one breach compromises all three.
- Turn on two-factor authentication wherever it’s offered — your domain registrar, hosting account, and CMS login especially. It’s the single highest-value five minutes you can spend on this list.
HTTPS isn’t optional anymore
If your site doesn’t show a padlock in the address bar, browsers actively warn visitors it’s not secure — which kills trust instantly and is genuinely embarrassing for a live business site in 2026. Most modern hosts (including the one we build on, Cloudflare Pages) issue this automatically for free, so if you’re seeing this warning, it’s almost always a DNS or hosting misconfiguration worth raising with whoever manages your site, not something to live with.
Forms are a common, overlooked opening
A contact or quote form with no spam protection doesn’t just fill your inbox with junk — it’s a common vector bots use to attempt more serious attacks, and a flood of spam submissions can quietly bury the one genuine enquiry you actually wanted. A basic spam filter (like Cloudflare Turnstile, which we use on our own contact form) blocks the vast majority of it without adding friction for a real customer filling it out.
Keep software current — or avoid needing to
If your site runs on WordPress or a similar CMS, out-of-date plugins and themes are the most common way small business sites actually get hacked — an old, unpatched plugin is a known, published vulnerability that automated bots actively scan for. Staying current matters enough that it’s usually worth a proper maintenance plan rather than hoping someone remembers; we’ve written a full checklist for what a maintenance plan should include. A static site with no database and no plugins avoids most of this category of risk entirely, which is one of the quieter advantages of that kind of build.
Watch for phishing aimed at your business, not just your site
A lot of “website security” incidents don’t start with the website at all — they start with a fake invoice, a spoofed email pretending to be your hosting provider, or a text claiming your domain’s about to expire. Slow down before clicking a link in an unexpected billing email, and go directly to the provider’s actual site to check rather than trusting the email’s link.
If something does go wrong
- Change every password immediately — site login, hosting, domain registrar, and any email account connected to them
- Restore from a recent backup if the site itself is compromised — this is exactly why a tested backup, not just an untested one, matters
- Tell your host — most have a process for this and can often help contain the damage faster than you can alone
- Check what data was actually exposed — if customer details (names, emails, payment info) were involved, you may have obligations under the Privacy Act to tell affected people
The honest answer
Website security for a small NZ business isn’t really about defending against a targeted, sophisticated attack — it’s about not being the easiest target in an automated scan. Old logins, weak passwords, missing HTTPS, and unpatched plugins are the openings that actually get used. Close those, and you’ve dealt with the overwhelming majority of real risk.