Website Security for People Who Aren't Security Experts

Hackers don't just target big companies. Small business websites are easier targets. If you're processing credit card payments, storing customer data, or have anything valuable on your site, you need basic security. Not complex security. Basic. Four things stop almost every attack that gets sent your way. You don't need to understand the technology. You need to do the work.

Move 1: Use HTTPS Everywhere

If your website address starts with http:// instead of https://, your data is vulnerable. HTTPS encrypts information between your customer's browser and your server. Anyone snooping on the connection can't see credit card numbers or passwords. Getting HTTPS is simple: it's usually free, and most hosting providers enable it in one click. If your site doesn't have it, enable it today. Chrome shows a warning when a site isn't secure, so you're probably losing customers already.

Move 2: Use Strong Passwords (Or a Password Manager)

Most hacks happen because someone uses "password123" or "companyname" as their admin password. A hacker guesses it in seconds. Use a password that's at least 12 characters long, with uppercase, lowercase, numbers, and special characters. Or use a password manager like 1Password or LastPass that creates and remembers strong passwords for you. You only remember one master password. Every other password is generated and unique. This stops most break-ins.

Move 3: Keep Your Software Updated

If you're using WordPress or any other platform, turn on automatic updates. Most security breaches happen because someone didn't update their software. The update fixes a known vulnerability. You skip the update, and a hacker exploits it. Set it and forget it. Enable automatic updates for your platform, plugins, and your server's operating system.

Move 4: Back Up Your Data Regularly

If you do get hacked, the damage is limited if you have a backup from before the attack. Most hosting providers offer backups for free. Some do it automatically. Check your hosting control panel and enable automatic backups if they're not already on. Then test one. Download a backup and confirm it works. A backup you've never tested is a backup that won't work when you need it.

• Check if your site uses https:// (not just http://). Enable it if it's not.
• Change your admin password to something strong or switch to a password manager.
• Turn on automatic updates for your website platform and plugins.

Security doesn't require a degree or a big budget. It requires doing four basic things. Do them today. You'll eliminate 95% of the risk.