A website security checklist for an Indian small business comes down to ten habits: HTTPS on every page, updates applied within a week, a separate login for each person with two-factor authentication, no unused plugins or themes, off-site backups you have actually restored, correct file permissions, a web application firewall, regular malware scans, spam protection on every form, and a written list of who has access to what. Get these right and you close the doors most small-business hacks walk through. Almost none of it needs an expensive product; it needs about an hour a month and one person who owns the job.
This page is about prevention. If your site is already hacked or has been suspended by your host, follow our guide to fixing a hacked WordPress website first.
Why small Indian websites get hacked
It is rarely personal. Automated bots constantly scan websites for known weak spots: a plugin version with a published vulnerability, an admin login protected by admin@123, a forgotten backup.zip sitting in the public folder. You are not being targeted; you are being found. Attackers usually want your server and your Google ranking, not your data: hidden spam pages, redirects to betting sites, or your hosting account sending bulk email.
Risk also depends on the site. A five-page site with no admin panel has little to attack; a WordPress store with 30 plugins has a great deal. Match the effort to the risk, and be wary of anyone selling a brochure site the same security package as an online store.
Common threats: what they look like and the fix
| Threat | What it looks like | The fix |
|---|---|---|
| Outdated plugin or theme exploited | Admin users you did not create, unknown files in the uploads folder, redirects that happen only on mobile | Update within a week, delete unused plugins, never install pirated “nulled” plugins |
| Password guessing (brute force) | Thousands of failed logins in the logs, locked accounts, hosting CPU limit warnings | Long unique passwords, two-factor login, limited login attempts |
| SEO spam injection | Japanese or pharmacy titles under your domain in Google; a Security issues alert in Search Console | Malware scan and clean-up, then close the entry point |
| Malicious redirect | Visitors from Google land on a gambling site, but the site looks normal when you type the address | Web application firewall, file-change alerts, check the .htaccess file |
| Form spam and fake leads | Hundreds of junk enquiries, your emails start landing in spam, mail quota exhausted | Honeypot plus invisible CAPTCHA, server-side validation, rate limits |
| Checkout script skimming | No visible change; customers report card fraud after buying from you | Use the payment gateway’s hosted checkout, watch for new scripts on checkout pages |
| Old staff or old agency access | Changes nobody admits to; you cannot log in to your own domain or hosting | An access register, removal on exit, every account in the business’s name |
| Deletion or failed update with no backup | Blank site; the host says the only backup is the infected one | Daily off-site backups with a tested restore |
The website security checklist: ten checks
1. HTTPS on every page
Every page should load over HTTPS, with HTTP redirecting automatically and no “mixed content” warnings. A free Let’s Encrypt certificate, which most Indian hosts install from the control panel, gives the same encryption as a paid one; paid certificates mainly add company validation that small businesses rarely need. Check that renewal is automatic, because free certificates expire every few months. The padlock only means the connection is encrypted; a hacked site can have a perfectly valid one.
2. Updates within a week
Most small-site hacks exploit a weakness that already has a published fix; the site simply never received it. Keep WordPress core, plugins and theme current, and ask your host for a PHP version that still gets security fixes (as of 2026, 8.2 or newer). Turn on automatic security updates, and for bigger updates on a site that earns money, take a backup first and check the key pages afterwards. Never install “nulled” premium plugins or themes from free download sites; they commonly carry hidden backdoors.
3. One person, one login, two-factor on
No shared “admin” account passed around on WhatsApp. Each person gets their own login with the lowest role that does the job: the person who posts blogs needs Editor, not Administrator. Use a password manager and long, unique passwords. Turn on two-factor authentication with an authenticator app in four places: the website admin, the hosting control panel, the domain registrar, and the email inbox that receives password resets. That inbox is the master key, so protect it first.
4. Delete what you do not use
A deactivated plugin is still code on your server, and it can still be exploited. Deactivate, then delete. Remove unused themes except one default fallback, old staging copies in folders such as /old/ or /test/, and any .zip or .sql backup files in the public folder, which bots hunt for. If a plugin’s author has not updated it in over a year, replace it.
5. Backups you have actually restored
Back up daily for a store or an active blog, weekly for a site that rarely changes. Store copies off the server, in cloud storage or with a different provider, because a backup on the same hosting account gets deleted or infected along with the site. Keep at least 30 days of history, since infections often go unnoticed for weeks. Once a quarter, restore one to a test subdomain. A backup you have never restored is a hope, not a plan. If you rely on your host’s backups, ask how long they are kept and whether a restore costs extra.
6. Sensible file permissions
The usual safe settings are 755 for folders and 644 for files, with the main configuration file (wp-config.php on WordPress) locked down further. Never set a folder to 777 “to fix an upload error”; that lets anything on the server write to it. Disable the dashboard’s built-in file editor, block scripts from running in the uploads folder, turn off directory listing, and use SFTP rather than plain FTP.
7. A web application firewall
A web application firewall (WAF) filters out malicious requests before they reach your site. It runs either at the network edge, as with Cloudflare or Sucuri, or as a plugin such as Wordfence. For most small sites, Cloudflare’s free plan is a sensible start, with a security plugin on top if you use WordPress. A firewall buys you time; it does not replace updates.
8. Malware scanning and early warnings
Run a server-side scan every week; many cPanel hosts include one, such as ImunifyAV. Verify your site in Google Search Console, which is free and emails you if Google detects hacked content. Add a free uptime monitor, and once a month search site:yourdomain.com in Google for pages you did not create.
9. Spam protection on every form
Use a hidden honeypot field plus an invisible CAPTCHA such as Cloudflare Turnstile or Google reCAPTCHA. Validate every field on the server, not just in the browser, and limit how many submissions one visitor can send. Send form emails through authenticated SMTP and set SPF, DKIM and DMARC records on your domain, so enquiries reach your inbox and nobody can easily spoof your address. If a form accepts file uploads, restrict the file type and size.
10. A written list of who has access
This is the check almost everyone skips. Keep one sheet listing every account — domain registrar, hosting, website admin, Cloudflare, Search Console, analytics, payment gateway, business email — with who has access, what role, and when it was granted. Review it whenever an employee, freelancer or agency leaves. The domain and hosting should sit in the business’s own name and email, not a developer’s personal account. At Codelith Lab we create the domain, hosting and every login in the client’s name from day one, so the list starts with the owner.
Card payments and customer data
If you sell online, let the payment gateway handle card details through its hosted or redirect checkout, so card numbers never touch your server; our payment gateway comparison covers the options. If you collect names and phone numbers, India’s data protection law expects reasonable security safeguards for that data, and this checklist covers much of the practical side. Separately, as of 2026, CERT-In’s 2022 directions require many organisations to report certain cyber incidents within six hours. Confirm with a lawyer whether that applies to you.
The monthly one-hour routine
- Take a backup, apply pending updates, then check the home page, one form and the checkout.
- Confirm last night’s backup exists off-site. Once a quarter, test a restore.
- Run a malware scan and check the Security issues report in Search Console.
- Review admin users and remove anyone you do not recognise or who has left.
- Delete plugins and themes that have sat deactivated for more than a month.
- Submit a test enquiry through every form and confirm it arrives outside the spam folder.
- Check the SSL expiry and domain renewal dates, with auto-renew switched on.
- Update the access sheet.
What this costs, and when you do not need to pay anyone
Most of this list is free: Let’s Encrypt SSL, Cloudflare’s free plan, Search Console, authenticator apps and the free versions of common security plugins. The real cost is someone’s time. Cheap shared hosting is not automatically unsafe, but check whether it includes malware scanning and off-site backups before choosing on price; our hosting cost guide covers what to ask.
If your site is small, runs on few plugins, and someone in your team will genuinely do the routine above every month, you do not need a paid maintenance plan. If you run a store, or nobody will realistically log in each week, pay someone and get the monthly routine in writing. For reference, our pricing for a care plan is ₹1,499 a month plus 18% GST, and our website maintenance cost guide compares what others charge and what should be included. If you are building a new site, asking for these checks at the website development stage is far cheaper than fixing them after a hack.
The short version
- Most hacks on small Indian sites come from outdated plugins, reused passwords and forgotten access, not clever attackers.
- Update within a week, use two-factor login everywhere, delete what you do not use, and keep off-site backups you have actually restored.
- Use a free firewall and Google Search Console so you hear about trouble before your customers do.
- Keep every account in the business’s name and review who has access whenever someone leaves.
Frequently Asked Questions
Is a free SSL certificate good enough for a business website?
Yes, for almost every small business site. A free Let’s Encrypt certificate gives the same encryption as a paid one, and most Indian hosts install and renew it automatically. Paid certificates mainly add organisation validation and a warranty, which matter more to banks and large portals than to a clinic or a manufacturer. What matters more is that every page redirects to HTTPS and that the certificate renews on time.
How often should a small business website be backed up?
Daily if the site changes often, such as an online store or an active blog, and weekly for a brochure site that rarely changes. Store copies away from your hosting account, keep at least 30 days of history, and restore one to a test subdomain every quarter. Infections are often found weeks after they happen, so a single recent backup may already contain the problem.
Do I need a paid security plugin or firewall?
Not always. Many small WordPress sites are well protected by prompt updates, two-factor login, Cloudflare’s free plan and the free version of a reputable security plugin. Paid tiers make sense for online stores, sites with many logged-in users, or sites that have been hacked before, because they usually add faster firewall rule updates and support. No firewall makes up for plugins that are months out of date.
Does this checklist apply if my site is on Wix, Shopify or another hosted builder?
Partly. Hosted platforms handle server updates, SSL, file permissions and most firewall work for you, which is a real advantage if nobody on your team will maintain a site. You still own the rest: long unique passwords, two-factor login, removing staff who leave, checking third-party apps before installing them, and protecting forms from spam. On a hosted platform, your login is the main thing left for an attacker to target.
Who is responsible for website security, the developer or the business owner?
In practice, the business owner, because the website, the customer data and the reputation are yours. A developer or agency can do the work under a maintenance contract, but that contract should list exactly what they check, how often, and how quickly they respond to a problem. Without that in writing, assume nobody is doing it. Either way, keep the domain, hosting and admin logins in your own name.
