Website security for SMEs: 10 measures that really protect

Website security for small and medium-sized businesses does not require expensive specialist technology, but discipline in ten areas: updates, backups, access, extensions, hosting, firewall, encryption, monitoring, responsibilities, and an emergency plan. Most successful attacks on SME websites exploit known vulnerabilities in outdated software, not sophisticated targeted attacks.

The critical PHP vulnerability PHP2Shell showed how quickly action is needed: the BSI considered widespread exploitation likely just hours after the patches. Anyone who maintains their website according to these ten points will be on the safe side quickly in such a situation.

The 10 measures

1. Install updates promptly

CMS, plugins, themes and PHP. Security updates within days, critical ones such as PHP2Shell immediately. Automatic updates for minor versions are usually sensible.

2. Backups stored separately and tested

Daily backup of files and database, kept for several days, in a separate location. And test at least once a year whether restoration really works.

3. Few administrators, strong authentication

Only as many admin accounts as necessary, personal instead of shared access, long passwords from a password manager, and two-factor authentication for all administrators.

4. Clean out extensions

Every plugin is additional code that may contain vulnerabilities. Delete anything you do not need — do not just deactivate it. Only use extensions that are actively maintained.

5. Hosting with security updates

Choose a host that updates PHP and servers promptly and informs you about warnings such as PHP2Shell. Ask how quickly critical updates are applied.

6. Do not expose admin interfaces to the internet

Login pages and web interfaces for firewalls, NAS devices or routers should only be accessible from the company network or via VPN. This significantly reduces the attack surface.

7. Web Application Firewall as a supplement

A WAF filters known attack patterns, for example via services such as Cloudflare. It does not replace updates, but it can bridge the time until a patch is applied.

8. HTTPS and security headers

Encrypted connections are standard. Additional security headers on the web server make certain attacks in the browser more difficult.

9. Monitoring

Notifications for changes to files, for new administrators, or when the website is unavailable. Google Search Console also reports security issues that Google detects.

10. Responsibility and emergency plan

Who installs updates? Who decides in an emergency to take the website offline? Who reports a data breach? A single sheet of paper with names and phone numbers can save hours in an emergency. What to do then is set out in Website hacked?.

Quick check: Where do you stand?

Every “no” is a starting point. In addition, the free SEO and GEO check reviews the technology and visibility of your website.

Unsure whether your website, online shop or devices are affected? Get in touch with us. We check your systems, install updates and tell you honestly what needs to be done — even if it turns out that everything is fine. To get started, all you need is a brief conversation.

Frequently Asked Questions

How often should I update my website?

Security updates within a few days, critical vulnerabilities immediately. A fixed weekly or biweekly maintenance schedule has proven effective.

Do I need a Web Application Firewall?

It is a sensible addition, especially for shops and websites with forms. However, it does not replace updates or secure operation.

What does website security cost?

The most important measures mainly cost time and discipline. If you do not want to handle this yourself, you can outsource maintenance and updates to a service provider.

As of October 2026.